If your app is about searching (business directories, dictionaries, etc) or a catalog of browsable items, it’s always a good idea to let your API use a read-only database user. Another use case would be for doing backups, no write permissions needed either.
Here is how to do that for PostgreSQL v9.0+ (syntax quasi-similar for MySQL):
-- Say we just created the user "pouet"
-- Allow the user to CONNECT
GRANT CONNECT ON DATABASE mydb TO pouet;