PHP & MySQL® Web Development All-in-One Desk Reference for Dummies®

1.4. Protecting Your MySQL Databases

You need to control access to the information in your database. You need to decide who can see the data and who can change it. If a bad guy gets a list of your customer's private information (such as credit card numbers), you clearly have a problem. You need to guard your data.

MySQL provides a security system for protecting your data. The system includes the following:

• MySQL accounts: No one can access the data in your database without an account. The account has a name the user must use. The account can also have a password that users must provide before they access the account. In addition, each account specifies where you can access the data from, such as only from the current computer or only from a specific domain.

• Permissions: MySQL uses account permissions to specify who can do what. Anyone using a valid account can connect to the MySQL server, but he or she can do only those things that are allowed by the permissions for the account. For example, an account might be set up so that users can select data but cannot insert or update data. Or, an account might be set up so that it can change the data in a specific table, but can only look at the data in another table.

You can create and delete accounts, add and change passwords, and add and remove permissions with SQL queries. You can send the SQL queries with either of the methods described in the previous section. You can also manage your MySQL accounts with features provided by phpMyAdmin. ...