1

I am working on a web application that requires auditing db queries in MySQL. In every application that I have developed or worked on it is standard practice to store the DB credentials in a protected configuration file and access the DB through that one user. Auditing, then, must be managed by the code (I'm using PHP).

My question: would it be better to create user accounts for each user in MySQL and use these credentials to create the DB connection? Doing so would allow MySQL to log the queries by each user either through the general query log or Mcafee's mysql-audit plugin.

I have read some older posts that claim allowing multiple user accounts creates security vulnerabilities, but I have not read a clear explanation of how/why.

It may be worth noting: admins create user accounts and set user permissions. Users cannot self-register.

Thanks for any help you can provide.

  • For selects only or also for updates and deletes? – Raymond Nijland Aug 27 '13 at 21:58
  • User permissions would be based on user and group. So some would be select only, and others would be allowed to update, insert, etc. – Leonard Aug 28 '13 at 0:04
  • As Leonard has said, you should limit the types of queries different users can make. Don't give write access, or ALTER TABLE access, to users that only need to read data. – Buttle Butkus Apr 17 '14 at 3:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.