Hands-on Lab·MySQL
MySQL Column-Level Privileges
Grant SELECT on three named columns and the account can read those three. Asking for a fourth returns 1143 - a third distinct denial, this time naming the column.
Users and Privileges Guide 18 of 45 Intermediate
- OSUbuntu 26.04 LTS
- MySQL8.4.10-0ubuntu0.26.04.1
- Authcaching_sha2_password
- TimeAbout 12 min
Column-level grants are stored in mysql.columns_priv and have existed for a long time. They are checked per statement, so they cost a little more than table-level grants.
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| db-a01 | 192.168.0.81 | Ubuntu 26.04 LTS | Primary / Source / Replica Set Member 1 | 2 Core | 4 GB | 50 GB |
This guide includes
Use this when a table has columns an account must not see. This matters because a grant can name columns rather than a whole table - and asking for one outside the grant produces its own distinct error.
- granting three named columns rather than the table
- reading exactly those three back
- asking for a column outside the grant, and meeting the third distinct denial
Before you start
- The
appdb.customerstable, which has acreditcolumn.
-
Grant three columns, not a table
-
Read the granted columns
-
Ask for a column outside the grant