Database designers building enterprise systems usually assign different sets of privileges to different users of DBMS. They can be as granular as needed.
However, in my experience, web frameworks usually use a single connection to a DBMS, and the privileges are assigned and enforced at the framework level, through some sort of access control scheme. The database connection used by the framework has full privileges on the database, because it may need to create or delete tables, when extensions are installed or removed, for example.
Sometimes there are vulnerable extensions of a framework that may allow SQL Injection attacks. These extensions are often developed by third parties, and not by the framework developers.
My question is:
What is the efficacy of providing multiple DB connections with varying privileges for different user groups of a web framework - as a security measure? For example, the connection for a system administrator may allow for creating and deleting tables, but the connection for a public user may only allow for reading certain tables.
This would not be a replacement for the Access Control scheme in the framework, but as an added measure against SQL Injection.
Is this a good idea, or completely unnecessary? Please explain.