Putting comma-separated values into a SQL column is a misuse of SQL, and that's why you can't find any clean way to do this.
If you must do things this way, try this.
UPDATE user SET access = CASE
WHEN access IS NULL OR access = '' THEN $id
WHEN FIND_IN_SET($id,access) IS NOT NULL THEN access
ELSE CONCAT_WS(',',access,$id) END
WHERE whatever;
The first WHEN handles the situation where access doesn't contain anything. The second handles the case where your $id value is already in access. And the ELSE appends your $id value.
But if you can, do this the SQL way instead. Try creating a separate table called user_access. Give it a user and an access column. Then INSERT a row to the table to add an $id, and DELETE one to remove. Why? You have a many::one relationship between access $id values and users, and that's done with a table.
concat()as Ken Lee suggested or normalize your data, one row per access level