How to fix ERROR 1143: Command denied to user for column in MySQL

MySQLINTERMEDIATEMEDIUMUpdated Dec 23, 2025· 201 views

MySQL Error 1143 occurs when a user attempts to access a column without the required column-level privileges. Grant the missing SELECT, INSERT, or UPDATE permission on that column to fix it.

Quick fix

Fixes 1143

ERROR 1143 (42000): SELECT command denied to user 'app_user'@'localhost' for column 'salary' in table 'employees'
  1. Identify which column is restricted
  2. Connect as the MySQL root user or admin
  3. Check current column privileges for the user
  4. Grant the required column privilege
mysql — error
ERROR 1143 (42000): SELECT command denied to user 'app_user'@'localhost' for column 'salary' in table 'employees'
ERROR 1143: Command denied to user for column

What this error means

MySQL Error 1143 (ER_COLUMNACCESS_DENIED_ERROR) is raised when a user issues a SELECT, INSERT, UPDATE, DELETE, or other statement that touches a column for which they lack explicit privileges. Unlike Error 1142 (which blocks access to all columns in a table), Error 1143 means the user has some column privileges but not for the specific column they're trying to access. MySQL enforces both table-level and column-level permissions, checking column privileges after table permissions pass. This error indicates a security restriction is preventing the operation.

Typical symptoms

  • SELECT statement fails with "command denied...for column" message
  • INSERT or UPDATE operations fail when writing to restricted columns
  • Application queries run for some columns but fail for others in same table
  • Users can SELECT from table but fail when specific columns are referenced
  • Error occurs with WHERE clauses referencing unauthorized columns

Common causes

  1. User lacks SELECT privilege on one or more columns in the table
  2. User was granted table-level SELECT but not column-level SELECT on specific columns
  3. User lacks UPDATE or INSERT privilege on columns they're trying to modify
  4. Query references a column in WHERE clause where user has no SELECT permission
  5. New columns added to table were not granted to existing user accounts
  6. View or stored procedure executes under a definer user without column privileges

How to fix "ERROR 1143: Command denied to user for column"

1Identify which column is restricted

The error message contains the restricted column name in format: "ERROR 1143 (42000): <command> command denied to user 'username'@'host' for column 'columnname' in table 'tablename'".

Example:

bash
ERROR 1143 (42000): SELECT command denied to user 'app_user'@'localhost' for column 'salary' in table 'employees'

Note the exact column name and table name from the error message.

2Connect as the MySQL root user or admin

Use your administrative account to check and modify permissions.

bash
mysql -u root -p

Enter your root password when prompted. You need admin privileges to grant column-level permissions.

3Check current column privileges for the user

Query the information schema to see what column privileges the user currently has:

sql
SELECT * FROM INFORMATION_SCHEMA.COLUMN_PRIVILEGES
WHERE GRANTEE = '"username"@"hostname"'
ORDER BY TABLE_NAME, COLUMN_NAME;

Replace username and hostname with the actual user account (including quotes). For example:

sql
SELECT * FROM INFORMATION_SCHEMA.COLUMN_PRIVILEGES
WHERE GRANTEE = '"app_user"@"localhost"'
ORDER BY TABLE_NAME, COLUMN_NAME;

This shows you exactly which columns have explicit privileges granted.

4Grant the required column privilege

Use the GRANT statement to grant the needed privilege on the specific column. The syntax depends on what operation the user needs:

For SELECT (reading column values):

sql
GRANT SELECT (column_name) ON database_name.table_name TO 'username'@'hostname';

For INSERT (adding values to column):

sql
GRANT INSERT (column_name) ON database_name.table_name TO 'username'@'hostname';

For UPDATE (modifying column values):

sql
GRANT UPDATE (column_name) ON database_name.table_name TO 'username'@'hostname';

For multiple columns:

sql
GRANT SELECT (id, name, email), UPDATE (email) ON mydb.users TO 'app_user'@'localhost';

Real example:

sql
GRANT SELECT (salary) ON company.employees TO 'report_user'@'localhost';
5Flush privileges to apply changes immediately

After granting privileges, flush the privileges table to reload permissions into memory:

sql
FLUSH PRIVILEGES;

Without this step, the user's existing connections may not see the new permissions. This forces MySQL to reload all user privileges from the mysql.user, mysql.db, and mysql.columns_priv tables.

6Verify the fix by reconnecting and retesting

Disconnect the restricted user and reconnect with a fresh session to ensure new privileges are loaded:

bash
mysql -u username -p

Then test the previously failing query:

sql
SELECT id, name, salary FROM employees WHERE salary > 50000;

If the query succeeds, the privilege issue is resolved. If the same error appears, verify the username and hostname match exactly (they're case-sensitive).

Advanced notes

Column-level privileges are stored in the mysql.columns_priv system table. Only INSERT, UPDATE, SELECT, and REFERENCES can be granted at the column level; other privileges like DROP, CREATE, ALTER only exist at table or database level.

In UPDATE statements, be aware that SELECT privilege is also required for columns referenced in the WHERE clause or on the right side of assignments (col1 = col2). Similarly, DELETE operations require SELECT privilege for columns in the WHERE clause.

If you need to grant table-level privileges instead of column-level (simplifies management but less secure), use: GRANT SELECT ON database_name.table_name TO 'username'@'hostname';

For views and stored procedures with DEFINER clauses, ensure the definer user has the required column privileges, or use SQL SECURITY INVOKER to execute under the invoker's permissions instead.

To revoke column-level privileges, use: REVOKE SELECT (column_name) ON database_name.table_name FROM 'username'@'hostname';

Frequently asked questions

What does "1143" mean?
MySQL Error 1143 (ER_COLUMNACCESS_DENIED_ERROR) is raised when a user issues a SELECT, INSERT, UPDATE, DELETE, or other statement that touches a column for which they lack explicit privileges. Unlike Error 1142 (which blocks access to all columns in a table), Error 1143 means the user has some column privileges but not for the specific column they're trying to access. MySQL enforces both table-level and column-level permissions, checking column privileges after table permissions pass.
How do I fix "1143"?
MySQL Error 1143 occurs when a user attempts to access a column without the required column-level privileges. Grant the missing SELECT, INSERT, or UPDATE permission on that column to fix it.
What causes "1143"?
User lacks SELECT privilege on one or more columns in the table User was granted table-level SELECT but not column-level SELECT on specific columns User lacks UPDATE or INSERT privilege on columns they're trying to modify
Is the "1143" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading