Database user accounts

[eluser]adamp1[/eluser]
I was just wondering what other people do when it comes to database user accounts for a website that need to read and write to the database.

I was taught that you should have 3 users.
1. An admin account which can create tables and perform maintenance on your database
2. An account which has read/write access to the database
3. An account which only has read access

The reason for this is no-one uses the admin account apart from the developer. Only the people in the control panel use the read/write account and the public only ever use the read account.

I don't know how this would be applied to CI but the only way I can think of is multiple DB connections.

It is a bit more complex but has added bonuses for security. What does everyone else do?

[eluser]Michael Wales[/eluser]
Probably not the best, security-wise, but I just use the same username/password for the entire database (with each application on my server receiving one database).

This is a pretty common scenario within the shared hosting world as well as in open source PHP projects. Really, the only chance you have of someone getting your username/password is if your server is misconfigured and they can view your configuration files.

I did have one project, that I did for work, that we used multiple users. It was a "For Sale Board" that we wanted people on-base to be able to read/write and people off base to only read. Since this was running across a DoD network, with a waiver to punch a hole in the firewall for the database connection, we were extra careful in that scenario.

It really wasn't necessary - but, worst case scenario if someone managed to view the source they would simply see the read account's information.