Database engines do not understand the contents of your tables. You can instruct them to set up a foreign key relationship between the Users
table and various other tables in the database, and they can enforce that - but the engine cannot automatically prevent a query from returning data that's tied to a different UserId
than the one that's stored in a variable or cookie or whatever, indicating who the person connected to your application is.
That's something that generally must be done specifically by the application. In most cases, I'd expect this to be done by giving the users of the application forms to fill out; from the input on the form, the application would build a query, including whatever business logic applied (like UserId
must match the ID value for the user running the query).
If you want to set up every user of your database as an actual database-level login, then some engines (can't recall if MySQL has this capability or not) allow for row-level security. However, this works with users and role set up in the database itself, not user accounts created in and managed by an application.