It looks like you have multiple permissions stored together in a string.
To you, the query looks like:
select * from friend where permission='4'
That means anything containing 4.
To mysql, it sees:
select * from friend where permission= ONLY '4'
// Meaning the permissions column can ONLY CONTAIN 4.
// Also, ONLY is meant as a visual, don't use it in queries.
Try:
find_in_set('4',permission) <> 0
// This means It needs to find number 4 and can't return 0 results.
Check out these for more info:
MySQL query finding values in a comma separated string
http://www.w3resource.com/mysql/string-functions/mysql-find_in_set-function.php