Take the 2-minute tour ×
Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.

I am working on a web application that requires auditing db queries in MySQL. In every application that I have developed or worked on it is standard practice to store the DB credentials in a protected configuration file and access the DB through that one user. Auditing, then, must be managed by the code (I'm using PHP).

My question: would it be better to create user accounts for each user in MySQL and use these credentials to create the DB connection? Doing so would allow MySQL to log the queries by each user either through the general query log or Mcafee's mysql-audit plugin.

I have read some older posts that claim allowing multiple user accounts creates security vulnerabilities, but I have not read a clear explanation of how/why.

It may be worth noting: admins create user accounts and set user permissions. Users cannot self-register.

Thanks for any help you can provide.

share|improve this question
    
For selects only or also for updates and deletes? –  Raymond Nijland Aug 27 '13 at 21:58
    
User permissions would be based on user and group. So some would be select only, and others would be allowed to update, insert, etc. –  Leonard Aug 28 '13 at 0:04
    
As Leonard has said, you should limit the types of queries different users can make. Don't give write access, or ALTER TABLE access, to users that only need to read data. –  Buttle Butkus Apr 17 at 3:01

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.