How to fix ERROR 1143: Command denied to user for column in MySQL

The error message contains the restricted column name in format: "ERROR 1143 (42000): <command> command denied to user 'username'@'host' for column 'columnname' in table 'tablename'".

Example:

ERROR 1143 (42000): SELECT command denied to user 'app_user'@'localhost' for column 'salary' in table 'employees'

Note the exact column name and table name from the error message.

Use your administrative account to check and modify permissions.

mysql -u root -p

Enter your root password when prompted. You need admin privileges to grant column-level permissions.

Query the information schema to see what column privileges the user currently has:

SELECT * FROM INFORMATION_SCHEMA.COLUMN_PRIVILEGES
WHERE GRANTEE = '"username"@"hostname"'
ORDER BY TABLE_NAME, COLUMN_NAME;

Replace username and hostname with the actual user account (including quotes). For example:

SELECT * FROM INFORMATION_SCHEMA.COLUMN_PRIVILEGES
WHERE GRANTEE = '"app_user"@"localhost"'
ORDER BY TABLE_NAME, COLUMN_NAME;

This shows you exactly which columns have explicit privileges granted.

Use the GRANT statement to grant the needed privilege on the specific column. The syntax depends on what operation the user needs:

For SELECT (reading column values):

GRANT SELECT (column_name) ON database_name.table_name TO 'username'@'hostname';

For INSERT (adding values to column):

GRANT INSERT (column_name) ON database_name.table_name TO 'username'@'hostname';

For UPDATE (modifying column values):

GRANT UPDATE (column_name) ON database_name.table_name TO 'username'@'hostname';

For multiple columns:

GRANT SELECT (id, name, email), UPDATE (email) ON mydb.users TO 'app_user'@'localhost';

Real example:

GRANT SELECT (salary) ON company.employees TO 'report_user'@'localhost';

After granting privileges, flush the privileges table to reload permissions into memory:

FLUSH PRIVILEGES;

Without this step, the user's existing connections may not see the new permissions. This forces MySQL to reload all user privileges from the mysql.user, mysql.db, and mysql.columns_priv tables.

Disconnect the restricted user and reconnect with a fresh session to ensure new privileges are loaded:

mysql -u username -p

Then test the previously failing query:

SELECT id, name, salary FROM employees WHERE salary > 50000;

If the query succeeds, the privilege issue is resolved. If the same error appears, verify the username and hostname match exactly (they're case-sensitive).