Use stored procedure to add users to database - mysql

Question

I'm trying to create a stored procedure that can grant users access to a database. The idea is that the procedure would take in one parameter (the given username) and then give the user access to a database. So, that normal Mariadb query to do this is:
GRANT ALL ON databaseNameHere.* TO 'userNameHere'#'%';
The problem is, 'userNameHere' needs to be in quotes to perform this query so I need to concatenate quotes to the given user name parameter.
I thought to do this with DECLARE as so:
DELIMITER $$
CREATE PROCEDURE GrantUserAccess(IN as_username CHAR(25))
BEGIN
SET #sql = CONCAT("GRANT ALL ON archimodels.* TO '" as_username "'#'%'")
PREPARE stmt FROM #sql;
EXECUTE stmt;
DEALLOCATE PREPARE stmt;
END$$
DELIMITER ;
I keep running into error statement:
You have an error in your SQL syntax; check the manual that
corresponds to your MariaDB server version for the right syntax to use
near '"'#'%'") PREPARE stmt FROM #sql; EXECUTE stmt; DEALLOCATE
PREPARE stmt; EN' at line 3
Here's an example of what I want to do, the only problem is I need to concatenate quotes to the username
https://www.oreilly.com/library/view/mysql-stored-procedure/0596100892/re39.html

Answer 1

There's a couple of things wrong.
1) The "smart quotes" curly quote and double quote characters in place of ASCII quote and double quote characters
2) to include the contents of a procedure parameter or variable in the text of a SQL statement, we'd need to use dynamic SQL PREPARE/EXECUTE/DEALLOCATE
We also need to ensure that the parameter passed in is valid; the GRANT statement is going to create user with no password if the user doesn't exist. And if the parameter happens to include a single quote character, that's going to break our SQL if we don't escape it. We might also consider using the TRIM() function to remove any leading or trailing spaces from the parameter.
Something like this:
DELIMITER $$
CREATE PROCEDURE GrantUserAccess(IN as_username CHAR(25))
BEGIN
SET #sql = CONCAT('GRANT ALL ON databaseNameHere.* TO '''
,REPLACE(as_username,'''','''''')
,'''#''%''' );
PREPARE stmt FROM #sql;
EXECUTE stmt;
DEALLOCATE PREPARE stmt;
SET #sql = '';
END$$
DELIMITER ;