title: MYSQL database design to Serialize or not
body: <p>We have an existing application that runs on php and mysql. We are in the process of adding fine grained user authorization, so that certain users only get access to certain resources. There are a few thousand users and approx 100 resources (although both are expected to grow).</p>
  
  <p>My DB design is something like:</p>
  
  <p><em>users:</em>
  id, name, email</p>
  
  <p><em>resources:</em>
  id, resource</p>
  
  <p><strong>OPTION 1</strong>
  So, if we approached this with typical db normalisation in mind, we would have the following table as well. I guess that we would follow the structure of users being denied permission unless there is a record in the user_resources table. If their permission is subsequently removed for a particular resource, then we just delete that row from the user_resources table.</p>
  
  <p>*user_resources:*
  user_id, resources_id</p>
  
  <p><strong>OPTION 2</strong>
  Another alternative would be to forget about the user_resources table and just create a new column in the users table (called permissions or similar) and store a serialized value of that users permissions in the users table. Each time we need to check a user's permission, we would have to unserialize this value.</p>
  
  <p>Which approach is considered better practice, and are there any major pro's or con's to either?</p>