Question

Is it possible to prevent someone other than those allowed from tampering with the database. I guess I am asking if there is an method other than the database login to hamper people from tampering with the database? I am aware of privileges and how only access to certain parts of the database for certain users. I am looking for something more in case someone manages to ascertain the correct username/password combination.

I am using this database in conjunction with a web server. The database server and web server are on different machines and behind a hardware firewall. The web server is only accessible through the firewall, and the database server accessible only through the web server.

I guess what I am asking is would it be feasible to create some sort of user control that creates a session id or something similar so that only if that id matches that stored when the user signed on will the query be run.

Answer 1

Yes you have some control on setting which user has what privilege. Of course if they get a hold of the root user password, then I think you may be out of luck.

Check out this link for some information regarding Granting/Revoking privileges.
http://beginner-sql-tutorial.com/sql-grant-revoke-privileges-roles.htm

Granting Syntax (from link)

GRANT privilege_name
ON object_name
TO {user_name |PUBLIC |role_name}
[WITH GRANT OPTION]; 

Revoke Syntax (from link)

REVOKE privilege_name
ON object_name
FROM {user_name |PUBLIC |role_name} 

More: Brian added as a comment that Symantec has a nice guide to securing MySQL. I just wanted to add that it contains a lot of very useful information as well, http://www.symantec.com/connect/articles/securing-mysql-step-step