I am working on a web application that requires auditing db queries in MySQL. In every application that I have developed or worked on it is standard practice to store the DB credentials in a protected configuration file and access the DB through that one user. Auditing, then, must be managed by the code (I'm using PHP).

My question: would it be better to create user accounts for each user in MySQL and use these credentials to create the DB connection? Doing so would allow MySQL to log the queries by each user either through the general query log or Mcafee's mysql-audit plugin.

I have read some older posts that claim allowing multiple user accounts creates security vulnerabilities, but I have not read a clear explanation of how/why.

It may be worth noting: admins create user accounts and set user permissions. Users cannot self-register.

Thanks for any help you can provide.

  • For selects only or also for updates and deletes? Aug 27, 2013 at 21:58
  • User permissions would be based on user and group. So some would be select only, and others would be allowed to update, insert, etc.
    – Leonard
    Aug 28, 2013 at 0:04
  • As Leonard has said, you should limit the types of queries different users can make. Don't give write access, or ALTER TABLE access, to users that only need to read data. Apr 17, 2014 at 3:01


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.