I don't think there is any best practice on this which is specific to MariaDB. You should instead be looking for best practice for banking apps and best practice for https://mariadb.com/kb/en/securing-mariadb/ more generally. I think you should do some of these things: Use granular privileges. Only grant as many privileges as a user really needs. Use https://mariadb.com/kb/en/roles_overview/ instead of granting privileges directly to the database users. (Note that if you want a user to have all privileges from its multiple roles simulataneously, i.e. without having to do SET ROLE every time to switch between them, you can create a special role for the user, set this as the default role for the user, and then grant the other roles to that role.) Consider using https://mariadb.com/kb/en/stored-procedure-overview/ and associated grants (GRANT EXECUTE ON PROCEDURE ...) for accessing particularly sensitive tables. You can then also write access information to an audit table. Create one user for each app (web app for users, mobile app for users, web app for admins, ...) For security reasons, database and apps should probably reside on different servers, so therefore the host part of the user account should not be localhost, but rather the IP address of the particular app server (assuming your IP addresses do not ever change). You should enforce strong database user passwords - consider e.g. the https://mariadb.com/kb/en/simple-password-check-plugin/ and the https://mariadb.com/kb/en/cracklib-password-check-plugin/ . There are obviously also database security concerns beyond just database users (such as encryption and using https://mariadb.com/kb/en/temporal-tables/ ), but that is out of scope here.

The REVOKE statement you ran revoked a privilege that was never granted, so it does nothing. If you have a look at the permissions, you will see that schema public has CREATE granted to PUBLIC (that is, everybody), so that's what you will have to revoke: REVOKE CREATE ON SCHEMA public FROM PUBLIC; Then you have to grant CREATE to the role that is supposed to create objects in that schema.

After reading through the other responses and your remarks, I feel like there are still things I can add. 1. User research If you cannot reach actual users, the second best group to work with are potential (new) users. What would designers of a entirely new app do? They don't have any users at their disposal because they user base is simply non-existent yet. You could treat your project the same way and start recruiting potential users. To find out which people to recruit you can start by creating https://www.nngroup.com/topic/personas/ and go as far as filling out a https://www.wikiwand.com/en/Business_Model_Canvas - whatever helps to get insights on who your potential users might be. A competitive analysis might also help here (e.g. to find out what are common or "bonus" features and maybe you can derive some user expectations from it). 2. Expert evaluation One user is always available: you. While you should never focus too much on the "I-methodology", don't forget that you can still find out a lot on your own. Especially when there is already an existing product that you want to improve. In order to improve, you first need to find out what needs improvement - and that is where evaluation comes in. There is a number of methods that could be applied here, for example https://www.nngroup.com/articles/how-to-conduct-a-heuristic-evaluation/ , a cognitive walkthrough, or other https://www.nngroup.com/articles/summary-of-usability-inspection-methods/ . These insights might also help you reflect on the characteristics of the app and you as its user, which might in turn help you to generate an informed definition of your target users, which you then can recruit for your user research -> back to step 1. To follow up on that and what was also mentioned by Dan: You don't have to make it perfect on first try. UX and Usability Design are iterative procedures. The goal is not to be perfect, because it will never be perfect for everybody. The goal is to learn and then make it better on the next try. Once you get more insights, you will adapt your target user definition or find out about real users and make more informed decisions in the next iteration.

If the online store already has a side column with filters so the user can immediately search for the product they are looking for, I don't think it's necessary to show one of each type. An online store should have the same philosophy as a real one and the main page is the sales showcase. If it's a supermarket, instead of placing each type of product that it sells, it would put the best sale options and suggestions. A good marketing plan would say that it's perhaps more important to show products by type of sale, such as "best sellers", "featured offers", "latest news" ... I would implement a recommended list of products in addition to the filter. Example store: https://www.levi.com/GB/en_GB/promo/c/levi_men_promo_north

Short answer: Go for Invisible captcha. It will not hamper the registration experience on your website for genuine users. Long Answer: CAPTCHA helps in identifying between real users and automated users/BOTs. It will avoid SPAM registration on your website. Is that a common occurrence that you have observed on your website? If yes, then review sections, the comment sections on your e-commerce website can be targeted for spam. I personally believe that Fake reviews, irrelevant comments are bad user experiences. So it's better to guard your website with CAPTCHA so that your genuine users do not suffer from Spam. The downside to having a CAPTCHA would mean that potential users would have to take efforts while registering to your website to prove that they are not a BOT. So a win-win scenario for both, registering users and you as a website owner would be to opt for invisible or silent CAPTCHA. You can get more information on it here: https://www.google.com/recaptcha/intro/invisible.html?ref=producthunt

Its entirely on topic: moderating is highly intense because if you are doing it properly you are watching users like a hawk - something interesting can happen in a fraction of a second - and you have to be alert enough to spot it. As to the number of sessions you can do: its difficult to give a number. The other criteria which drives available time is building enough analysis time into the schedule so you have time to think about what is going on, so if there's a pattern emerging you can ask 'better questions' to later test subjects using what you've learnt from the earlier ones.

I think you are thinking of a design intended for paper rather than for a website. If before starting to create the website you define a margin of 100 px at each border, you will soon find functionality problems in the design adapted to a smartphone or tablet. Personally when I start a project I usually define the preferred maximum width of the work area instead of the margins: for wider margins, narrower work area. These margins will be relegated to larger screen widths or disappear on mobile devices. Picture from http://www.myebox.com/blog/responsive-design

We do this:pgAdmin IIIconnection to serverLogin RolesNew login rolename and passwordAcceptance.We could use a command line, for example, Ubuntu:sudo -u postgres createuser --superuser пользователь sudo -u postgres psql andpostgres=# \password пользователь

static auto_id(name, callback){ mongo_db.collection('__counters').findAndModify( { _id: name }, [], { $inc: { "inc": 1 } }, { new: true , upsert:true}, (err, response)=>{ callback(response.value.inc); } ); } That's what I found, an elegant solution.

Best store all user files in a single table, for example, mediafilesEach user file shall be marked with an external key where the user identifier is storedTable usersid name 1 Первый 2 Второй 3 Третий Table mediafilesid user_id path 1 1 img1.jpg 2 1 logo.jpg 3 2 hello.jpg 4 2 logotype.jpg 5 3 my.jpg If it's about downloading files, then you'd better start another table. downloadswhich connects usersuser_idand downloaded files (file_id)Table downloadsid user_id file_id 1 1 27 2 1 1123 3 2 12 4 2 8 5 3 84

Create a table of rights for groups and gender-specific features tinyint 1(or ENUM 0.1 for knowing interpretations in perverts), respectively 1 is right, 0 is not. Set up a group table, make Foreign key on Primary Key, the user table makes a field of the Group, which also makes Foreign Key Tables on Primary Key Group Tables.Well, I'd do it on the OBD. Well, there's a Yii on the server code, even though CodeIgniter has a zero code, no difference. ♪ ♪That is, for example, when authorizing the session, the current importance of the group, something like $_SESSION['user_group'] = $sqlResultArray['group'] and can already be identified by the current group, in any case this is all the subtle implementation and specific needs

You don't have to give access to players at MySQL. The user of MySQL must be alone: this is your annex.The location for security depends on how the annex works. If this is a web application, he should have his own copying system.If a dektop or mobile, it should connect HTTPS to the server, send a request (REST, JSON) and the server should already go to MySQL.Never publish the MySQL protocol outside, never let users go right there and not light the tables.

Write a console to work with the User model.

In this case, the problem was that the user from whom access to the database was not entitled VIEW DEFINITION and ALTERI understand.

In your case, you can use, for example, PAM. http://www.postgresql.org/docs/9.4/static/auth-methods.html

https://www.drupal.org/project/profile2 " https://www.drupal.org/project/profile2_regpath bluntly give a way to register for the type of section 1... for type two profiles different paths, etc.OR: https://www.drupal.org/project/rules " https://www.drupal.org/project/conditional_fields To create a field for the selection of a role in the profile of the laser (standard), to choose its role, on the basis of the role it has chosen, to appoint a role with the help of the rules and hide or show different fields for different roles depending on the choice of the laser with the help of Conditional Fields♪

Create a branchHKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\CurrentVersion\Winlogon\SpecialAccounts\UserListcreate a parameter DWORLD with the name of the user to cover 0, the user is hidden.

There's an opinion in narrow circles that "people using ubuntu think it's linux." It's a joke, but there's a part of the truth:Actually, there's a difference, but another case will see if you need it. If you use Ubuntu as a home desktop, you don't have to mess. Now, if you're using industry, let's talk about what area and stuff, then we'll tell you.It's a little bit confusing, but I think I understand.

Duck, give all the lasers one foot and let them come in. Well, if we have to log everyone and a few dozen people, then there's got to be a LDAP server, at least... IMO

I think http://www.opennet.ru/man.shtml?topic=forkpty&category=3&russian=1 That's what you need.There's a pseudoterminal.ptyWe have to work. In principle, it's not very difficult to write a bidirectional analogue. popen() on pseudotterminele instead pipe♪ For example, expect Makes it that way. spawn♪For example, you can read http://www.gnu.org/software/libc/manual/html_node/Low_002dLevel-Terminal-Interface.html#Low_002dLevel-Terminal-Interface ♪ Or shorter. https://stackoverflow.com/questions/476354/how-do-nix-pseudo-terminals-work-whats-the-master-slave-channel ♪ The idea is you're doing a pseudotterminal. master and slave (single like usual) tty(laughs) fork and there. dup descriptors 0,1,2 ♪ slaveAfter exec passwd She thinks she's working with the terminal. The parent process is exchanged by bahtists master♪Reply prepared from comments written https://ru.stackoverflow.com/users/232 to the question.