Question

> show grants for user_readonly;
+------------------------------------------------------------------------------------------------------------+
| Grants for user_readonly@%                                                                                   |
+------------------------------------------------------------------------------------------------------------+
| GRANT USAGE ON *.* TO 'user_readonly'@'%' IDENTIFIED BY PASSWORD '*F60F5EBDA2568D53C7CBFD0297F1BAA324B06AABD' |
| GRANT ALL PRIVILEGES ON `mydb`.* TO 'user_readonly'@'%'                                                      |
+------------------------------------------------------------------------------------------------------------+
2 rows in set (0.00 sec)

Currently, user_readonly has grants for everything. How can I change this so he can ONLY read?

Answer 1

REVOKE does the opposite from grant. The easiest way is to REVOKE ALL and then selectively re-grant the rights the user actually needs. And generally speaking, GRANT ALL should be used cautiously.