Beginning SQL

Chapter 12
Another shortcut, using the PUBLIC keyword, grants privileges to all users:
GRANT SELECT
ON tblHolidays
TO PUBLIC
Using the PUBLIC keyword has the advantage of not having to explicitly grant privileges to users, since
any current or even future authorized users are automatically in the listed privilege.
Try It Out Using the GRANT Statement
The GRANT statement creates an entry in the security system that allows a user in the current database to
work with data in the current database or execute specific Transact-SQL statements.
In the SQL window, type the following statement:
GRANT SELECT, INSERT, UPDATE
ON Attendance
TO DataEntry
GO
GRANT SELECT
ON Attendance
TO Management
GO
How It Works
Once the role is created, members are added to the role. This step allows members to inherit privileges
for the roles that they play in the database. By running a GRANT statement on a given table or object, you
assign specific privileges to that group (role in SQL Server) or user for that specific object. In this case,
you have granted SELECT, INSERT, and UPDATE privileges to the DataEntry group, and you have
granted only SELECT privileges to the Management group.
Columns
342
The SQL1 standard allowed GRANT UPDATE privilege on individual columns of a table or view, while the
SQL2 standard expanded that to include INSERT and REFERENCES privileges. The syntax lists the
columns after the PRIVILEGE keyword, and they must be between parentheses and comma-delimited
(separated by commas) if there are more than one. As an example, to give shipping personnel privileges
to specific columns in the order item table, you could write a GRANT statement similar to the following:
GRANT UPDATE (ShipDate, Quantity)
ON tblOrderItem
TO usrShipping
As you have already seen, the SQL standard does not permit a column list for a SELECT privilege. The
SELECT privilege must apply to all columns of the table or view. The normal method of handling this
restriction is simply to create a view of the desired columns and then grant a SELECT privilege on the
view. Of course, this forces you to design views that wouldn’t be necessary if a column list were allowed.
For this reason, many of the DBMSs provide extensions to the standard to allow column lists in the
SELECT grant statements. These extensions allow you to write statements like this: