Editing Data control language (section)

== Microsoft SQL Server ==
In [[Microsoft SQL Server]] there are four groups of SQL commands:<ref name="sql-server-tip-card">{{Cite web|title=SQL Clause, Statement, Command, Expression and Batch Defined|first=Aubrey|last=Love|date=March 28, 2023|url=https://www.mssqltips.com/sqlservertip/7575/sql-clause-statement-command-expression-batch-definition/|access-date=2025-01-26|website=MSSQLTips}}</ref>
* Data Manipulation Language (DML)
* Data Definition Language (DDL)
* Data Control Language (DCL)
* Transaction Control Language (TCL)

DCL commands are used for access control and permission management for users in the database. With them we can easily allow or deny some actions for users on the tables or records (row level security).

DCL commands are:<ref name="sql-server-tip-card" />
;GRANT: gives specified permissions for the table (and other objects) to, or assigns a specified role with certain permissions to, specified groups or users of a database;
;REVOKE: takes away specified permissions for the table (and other objects) to, or takes away a specified role with certain permissions to, specified groups or users of a database;
;DENY: denies a specified permission to a security object.

For example: GRANT can be used to give privileges to user to do SELECT, INSERT, UPDATE and DELETE on a specific table or multiple tables.

The REVOKE command is used to take a privilege away (default) or revoking specific command like UPDATE or DELETE based on requirements.

=== Example ===
{{sxhl|2=tsql|
Grant SELECT,INSERT,UPDATE,DELETE on Employees To User1

Revoke INSERT On Employees To User1

Deny Update On Employees to User1
}}
In the first example, GRANT gives privileges to user User1 to do SELECT, INSERT, UPDATE and DELETE on the table named Employees.

In the second example, REVOKE removes User1's privileges to use the INSERT command on the table Employees.

DENY is a specific command. We can conclude that every user has a list of privilege which is denied or granted so command DENY is there to explicitly ban you some privileges on the database objects.: