MySQL permissions etc.

bu22

When working with persistent connections, is it a good idea to create different database users with different permissions. For example, one user with select permissions, one with update, one with insert, one with delete etc..

I guess this would mean that if I had a connection open with the "select" user, then connecting again with this user would use the same persistent connection, but if I connect with a different user (the "update" user for example), this would create a seperate connection which would only stay persistent for connections made by the "update" user.

Is this generally a good idea? is there a better way to do it?

Cheers for any advice.

trooper

Do you really need to use persistant connections ?

Mysql and PHP are generally fast enough when using normal connections.

When i develop sites i always have 2 user types. One that actually generates the content (this user follows the least priviledges pricincple - that is only giving the user the minimum priviledges it needs to create the content etc (generally SELECT and thats it), that way if someone does try and mess with the site then the user they are running doesn't have enough privildges to do any damange).

The other user (which is used when using the CMS (accessable only via a pwd protected dir)) has the minimal priviledges that are needed in order to make changes to the site. I'd say that SELECT, UPDATE, INSERT AND DELETE are enough.

Always be aware that if you give too many priviledges then one day they could be used to wreak havoc on your site by some malicious user.

So in short - only give the least amount of priviedges needed to do the job.

After all a network administrator doesn't (or at least shouldn't) give an ordinary network user rights to delete user accounts does he?

HTH

bu22

Thanks for your reply.

I have a couple of questions still...

1) Why not use persistent connections? I thought they made database access more efficient? Is there any reason you shouldn't use them?

2) I understand you having a user with UPDATE, INSERT etc privileges in a pwd protected dir, for the admin section of your site, but what if I want to write to the database in the main "content" section? For example, I want to store page views, or I want to save a new registered user to the database etc.. Wouldn't I need to have a user with these privileges then?

Cheers for any help.

trooper

Take a look at this article.

If you want to allow a user to enter from the normal site then yes you will want to give that user INSERT priviledge

HTH

bu22

Cheers,

Thanks for your help!