MySQL Error 1143: Column Access Denied

MySQL Error 1143 (42000, ER_COLUMNACCESS_DENIED_ERROR) means the connected account lacks a privilege for the named command on a specific column. The message includes the command, account, column, and table. This is a request-authorization failure after the connection was accepted. See the MySQL 8.4 error reference.

Check the account and the denied column

Run these statements in the same connection that produced the error:

SELECT USER() AS connection_identity,
       CURRENT_USER() AS privilege_account;

SHOW GRANTS FOR CURRENT_USER;

Use the account returned by CURRENT_USER() when checking grants. It can differ from the username and host supplied by the client. If the account uses roles in MySQL 8.0 or later, also check active roles with SELECT CURRENT_ROLE();; a granted but inactive role does not contribute privileges to the session. See connection verification, MySQL roles, and SHOW GRANTS.

Compare the denied column with the statement. A query that selects several columns needs access to each requested column; an update or insert can likewise require privileges on the named columns. Check table- and column-level grants and any active roles rather than assuming a successful connection grants access to every column.

Grant access to only the required column

Ask an administrator or an account authorized to grant privileges. For example, if report_reader needs to read only the email column, grant SELECT for that column to the exact account:

GRANT SELECT (`email`)
ON `app_db`.`users`
TO 'report_reader'@'localhost';

Replace the example schema, table, column, user, and host with the real values. MySQL supports column-level SELECT, INSERT, REFERENCES, and UPDATE privileges; the privilege must include a column list. See the column privilege syntax.

If the application legitimately needs every column in the table, a table-level grant such as GRANT SELECT ON app_db.users ... is broader and may be appropriate. Do not use a global GRANT ALL ON *.* to fix one column denial. For the complete syntax and scope examples, see the SQLiz MySQL GRANT guide.

Distinguish related access errors

• Error 1143 (42000): a command is denied for a named column.
• Error 1142 (42000): a command is denied for a named table; see Error 1142 troubleshooting.
• Error 1044 (42000): the account lacks access to the named database; see Error 1044 troubleshooting.
• Error 1045 (28000): MySQL rejected the account during connection authentication; see Error 1045 troubleshooting.

For more codes, browse MySQL Error Troubleshooting.