20.07.2013 Views

Beginning SQL

Beginning SQL

Beginning SQL

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

Limitations on Views<br />

Views are by their nature SELECT statements and thus are read-only in most security schemes. If the user<br />

needs to be able to modify, insert, or delete the data in the view, the user must be granted those privileges<br />

to the underlying tables. If more than a single table is used in the view, it may not be possible to perform<br />

updates on the view even with privileges, depending on the complexity of the view and the specific<br />

implementation of the DBMS that you are using.<br />

Remember also that views have a negative impact on the performance of the database since the view has<br />

to be translated into queries on the underlying tables.<br />

Granting Privileges<br />

The basic GRANT statement is used to grant security privileges on database objects to specific users or, in<br />

some DBMS implementations, to groups. For <strong>SQL</strong>2 compatibility, the GRANT statement works only for<br />

user IDs; groups don’t exist. When you create a table, you are the owner of that table and you can use<br />

the GRANT statement to grant privileges to any user you want. With views, you can use the GRANT ALL<br />

statement to grant all privileges on the view. However, if you don’t own the underlying tables, the<br />

GRANT you give is only as good as the privileges you hold on the underlying tables; furthermore, you<br />

have to hold a WITH GRANT OPTION on the privileges you are granting, as explained later in this section.<br />

Tables and Views<br />

In <strong>SQL</strong>1, GRANT dealt only with tables. Users are granted privileges on the entire table. The GRANT statement<br />

looks similar to the following:<br />

GRANT SELECT, INSERT, DELETE, UPDATE<br />

ON tblPersonnel<br />

TO usrPersonnel<br />

This statement gives all privileges on tblPersonnel to the user ID usrPersonnel.<br />

The statements to allow an order entry clerk to add orders but to allow only shipping to view the orders<br />

might look like this:<br />

GRANT SELECT, INSERT<br />

ON tblOrders<br />

TO usrOrderEntry<br />

GRANT SELECT<br />

ON tblOrders<br />

TO usrShipping<br />

Instead of specifically listing SELECT, INSERT, DELETE, and UPDATE for an object (as illustrated in the<br />

preceding code), the GRANT syntax also has a shortcut used to grant ALL PRIVILEGES to a specific user<br />

or group:<br />

GRANT ALL PRIVILEGES<br />

ON tblPersonnel<br />

TO usrPersonnel<br />

<strong>SQL</strong> Security<br />

341

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!