REVOKE Privileges
In this page:
What is REVOKE?
REVOKE is the direct opposite of GRANT — instead of handing out a permission, it removes one that was previously assigned, which is essential when a user's role changes or a project they had access to wraps up.
Example: What is REVOKE?
REVOKE INSERT ON mydb.* FROM 'app_user'@'localhost';Revoking All Privileges
Revoking every privilege from an account at once leaves the login itself intact but strips it of any ability to act on the database, effectively neutralizing the account without deleting it outright.
Example: Revoking All Privileges
REVOKE ALL PRIVILEGES, GRANT OPTION FROM 'app_user'@'localhost';Revoking Specific Column Privileges
Just as column-level privileges can be granted, they can also be revoked individually, removing access to one specific column while leaving the user's permissions on every other column of that table unchanged.
Example: Revoking Specific Column Privileges
REVOKE SELECT (salary) ON mydb.employees FROM 'app_user'@'localhost';Applying Revocations
After revoking permissions, running a flush command ensures the change takes effect right away rather than waiting for cached privilege data to refresh on its own.
Example: Applying Revocations
REVOKE INSERT ON mydb.* FROM 'app_user'@'localhost';
FLUSH PRIVILEGES;Common Mistakes with REVOKE
A REVOKE statement must match the exact scope of the original GRANT — you can't remove a database-level permission using a broader global wildcard, so the syntax has to mirror how the access was originally granted.
Example: Common Mistakes with REVOKE
-- Granted at the database level:
GRANT SELECT ON mydb.* TO 'app_user'@'localhost';
-- Wrong: a broader global scope doesn't match the original grant
-- REVOKE SELECT ON *.* FROM 'app_user'@'localhost';
-- Correct: mirror the original scope exactly
REVOKE SELECT ON mydb.* FROM 'app_user'@'localhost';Chapter Quiz — Complete all 6 topics to unlock
0/6 topics done
Complete these topics first: