MySQL - REVOKE Statement

The MySQL REVOKE statement is used to revoke the privileges or roles on an account.
Following is the syntax of the MySQL REVOKE Statement −
REVOKE
   privilege1, privilege2, privilege3....
   ON [object_type] priv_level
   TO user_or_role1, user_or_role2, user_or_role3....

Assume we have created a user named 'test_user'@'localhost' in MySQL using the CREATE USER statement −
mysql> CREATE USER 'test_user'@'localhost' IDENTIFIED BY 'testpassword';
Query OK, 0 rows affected (0.23 sec)
Now, let us create a database and create a table in it.
mysql> CREATE DATABASE test_database;
Query OK, 1 row affected (0.56 sec)

mysql> USE test_database;
Database changed

mysql> CREATE TABLE MyTable(data VARCHAR(255));
Query OK, 0 rows affected (0.67 sec)
Following query grants privileges on the table created above, to the user 'test_user'@'localhost −
mysql> GRANT SELECT ON test_database.MyTable TO 'test_user'@'localhost';
Query OK, 0 rows affected (0.31 sec)
You can verify the granted privileges using the SHOW GRANTS statements −
mysql> SHOW GRANTS FOR 'test_user'@'localhost';
+----------------------------------------------------------------------+ 
| Grants for test_user@localhost                                       |
+----------------------------------------------------------------------+
| GRANT USAGE ON *.* TO `test_user`@`localhost`                        |
| GRANT SELECT ON `test_database`.`mytable` TO `test_user`@`localhost` |
+----------------------------------------------------------------------+
2 rows in set (0.00 sec)
Now, you can revoke the above granted privilege using the REVOKE statement as shown below −
mysql> REVOKE SELECT ON test_database.MyTable FROM 'test_user'@'localhost';
Query OK, 0 rows affected (0.25 sec)
If you verify the list of grants for the user aging you can observe that the SELECT privilege is removed from the list.
mysql> SHOW GRANTS FOR 'test_user'@'localhost';
+-----------------------------------------------+
| Grants for test_user@localhost                |
+-----------------------------------------------+
| GRANT USAGE ON *.* TO `test_user`@`localhost` |
+-----------------------------------------------+
1 row in set (0.00 sec)
If a user has multiple privileges with a user, you can revoke all those privileges at once using the REVOKE ALL statement. Following is the syntax to do so −
REVOKE ALL [PRIVILEGES], GRANT OPTION
   FROM user_or_role [, user_or_role] ... 
Assume we have created a user, a procedure and a table with the name sample in the database as follows −
mysql> CREATE USER 'sample_user'@'localhost';
Query OK, 0 rows affected (0.18 sec)

//Creating a procedure
mysql> DELIMITER //

mysql> CREATE PROCEDURE sample ()
   BEGIN
      SELECT 'This is a sample procedure';
   END//
Query OK, 0 rows affected (0.29 sec)
mysql> DELIMITER ;

mysql> CREATE TABLE sample(data INT);
Query OK, 0 rows affected (0.68 sec)
Following queries grants ALTER ROUTINE, EXECUTE privileges on the above created procedure to the user named 'sample_user'@'localhost'.
mysql> GRANT ALTER ROUTINE, EXECUTE ON PROCEDURE test_database.sample TO 'sample_user'@'localhost';
Query OK, 0 rows affected (0.20 sec)
Similarly, following query grants SELECT, INSERT and UPDATE privileges on the table sample to the user 'sample_user'@'localhost −
mysql> GRANT SELECT, INSERT, UPDATE ON test.sample TO 'sample_user'@'localhost';
Query OK, 0 rows affected (0.14 sec)
You can verify the list of all privileges granted for the user −
mysql> SHOW GRANTS FOR 'sample_user'@'localhost';
+-------------------------------------------------------------------------------------------------+
| Grants for sample_user@localhost                                                                |
+-------------------------------------------------------------------------------------------------+
| GRANT USAGE ON *.* TO `sample_user`@`localhost`                                                 |
| GRANT SELECT, INSERT, UPDATE ON `test`.`sample` TO `sample_user`@`localhost`                    |
| GRANT EXECUTE, ALTER ROUTINE ON PROCEDURE `test_database`.`sample` TO `sample_user`@`localhost` |
+-------------------------------------------------------------------------------------------------+
3 rows in set (0.00 sec)
Following query revokes all the privileges granted to the user 'sample_user'@'localhost' −
mysql> REVOKE ALL PRIVILEGES, GRANT OPTION FROM 'sample_user'@'localhost';
Query OK, 0 rows affected (0.30 sec)
mysql> SHOW GRANTS FOR 'sample_user'@'localhost';
+-------------------------------------------------+
| Grants for sample_user@localhost                |
+-------------------------------------------------+
| GRANT USAGE ON *.* TO `sample_user`@`localhost` |
+-------------------------------------------------+
1 row in set (0.00 sec)
You can make one user as a proxy of another by granting the PROXY privilege to it. If you do so both users have the same privileges.
Assume we have created a users named sample_user, proxy_user and a table named Emp in MySQL using the CREATE statement −
mysql> CREATE USER sample_user, proxy_user IDENTIFIED BY 'testpassword';
Query OK, 0 rows affected (0.52 sec)

mysql> CREATE TABLE Emp (ID INT, Name VARCHAR(15), Phone INT, SAL INT);
Query OK, 0 rows affected (6.47 sec)
Following query grants SELECT and INSERT privileges on the table created above, to the user sample_user −
mysql> GRANT SELECT, INSERT ON Emp TO sample_user;
Query OK, 0 rows affected (0.28 sec)
Now, we can assign proxy privileges to the user proxy_user, using the GRANT statement as shown below −
mysql> GRANT PROXY ON sample_user TO proxy_user;
Query OK, 0 rows affected (1.61 sec)
You can revoke a proxy privilege using the REVOKE PROXY statement as shown below −
mysql> REVOKE PROXY ON sample_user FROM proxy_user;
Query OK, 0 rows affected (0.33 sec)
A role in MySQL is a set of privileges with name. You can create one or more roles in MySQL using the CREATE ROLE statement. If you use the GRANT statement without the ON clause you can grant a role instead of privileges.
Following query creates a role named TestRole_ReadOnly.
mysql> CREATE ROLE 'TestRole_ReadOnly';
Query OK, 0 rows affected (0.13 sec)
Now, let’s grant read only privilege to the created role using the GRANT statement as −
mysql> GRANT SELECT ON * . * TO 'TestRole_ReadOnly';
Query OK, 0 rows affected (0.14 sec)
Then, you can GRANT the created role to a user as follows −
mysql> CREATE USER 'newuser'@'localhost' IDENTIFIED BY 'password';
Query OK, 0 rows affected (0.14 sec)

mysql>  GRANT 'TestRole_ReadOnly' TO 'newuser'@'localhost';
Query OK, 0 rows affected (0.13 sec)
Following query revokes the role from the user −
mysql> REVOKE 'TestRole_ReadOnly' FROM 'newuser'@'localhost';
Query OK, 0 rows affected (1.23 sec)