REVOKE Privileges

REVOKE is like taking back a permission slip you gave earlier, so that person can no longer do that thing.

In this page:

What is REVOKE?
Revoking All Privileges
Revoking Specific Column Privileges
Applying Revocations
Common Mistakes with REVOKE

Syntax

sql

REVOKE privilege1, privilege2
ON database_name.table_name
FROM 'username'@'host';

What is REVOKE?

REVOKE is the direct opposite of GRANT — instead of handing out a permission, it removes one that was previously assigned, which is essential when a user's role changes or a project they had access to wraps up.

Example: What is REVOKE?

sql

REVOKE INSERT ON mydb.* FROM 'app_user'@'localhost';

Revoking All Privileges

Revoking every privilege from an account at once leaves the login itself intact but strips it of any ability to act on the database, effectively neutralizing the account without deleting it outright.

Example: Revoking All Privileges

sql

REVOKE ALL PRIVILEGES, GRANT OPTION FROM 'app_user'@'localhost';

Revoking Specific Column Privileges

Just as column-level privileges can be granted, they can also be revoked individually, removing access to one specific column while leaving the user's permissions on every other column of that table unchanged.

Example: Revoking Specific Column Privileges

sql

REVOKE SELECT (salary) ON mydb.employees FROM 'app_user'@'localhost';

Applying Revocations

After revoking permissions, running a flush command ensures the change takes effect right away rather than waiting for cached privilege data to refresh on its own.

Example: Applying Revocations

sql

REVOKE INSERT ON mydb.* FROM 'app_user'@'localhost';
FLUSH PRIVILEGES;

Common Mistakes with REVOKE

A REVOKE statement must match the exact scope of the original GRANT — you can't remove a database-level permission using a broader global wildcard, so the syntax has to mirror how the access was originally granted.

Example: Common Mistakes with REVOKE

sql

-- Granted at the database level:
GRANT SELECT ON mydb.* TO 'app_user'@'localhost';
-- Wrong: a broader global scope doesn't match the original grant
-- REVOKE SELECT ON *.* FROM 'app_user'@'localhost';
-- Correct: mirror the original scope exactly
REVOKE SELECT ON mydb.* FROM 'app_user'@'localhost';

Chapter Quiz — Complete all 6 topics to unlock

0/6 topics done

Complete these topics first:

← Previous Lesson GRANT Privileges Next Lesson → DROP USER