I am building a site where people set up small, private, social networks. For ease of administration and portability, I would like each network to be stored in a different MySQL database.
I understand that there is no artificial limit on the number of databases a MySQL server can handle, and in my basic tests there is no measurable performance impact. What I would like to know is: if I allow these databases to be set up without my intervention, what are the security implications?
My thoughts so far:
For general usage, the app would connect to MySQL as a user with limited "SELECT", "INSERT", "UPDATE", "DELETE" rights. This user would be granted rights to read/write into each created database.
When a new network is created, the app would connect to MySQL as a special user with the "CREATE" privelege, so it can create a new database.
I would only allow a new database to be created if I am convinced the person is a legitimate user (email validation, captcha etc).
If illegitimate databases are created, I will notice and delete them, and hopefully figure out how to prevent more being created.
With a setup like this, is there any security implications I have not thought of? Is there any danger, other than the possible creation of databases by illegitimate users?