MySQL 允许创建账户，这些账户可以让客户端用户连接到服务器并访问服务器管理的数据。MySQL 权限系统的主要功能是验证从指定主机连接的用户，并将该用户与数据库上的权限关联，例如 SELECT、INSERT、UPDATE 和 DELETE。其他功能包括授予管理操作权限的能力。MySQL enables the creation of accounts that permit client users to connect to the server and access data managed by the server. The primary function of the MySQL privilege system is to authenticate a user who connects from a given host and to associate that user with privileges on a database such as SELECT, INSERT, UPDATE, and DELETE. Additional functionality includes the ability to grant privileges for administrative operations.

为了控制哪些用户可以连接，每个账户可以分配认证凭证，如密码。MySQL 账户的用户界面由 SQL 语句组成，例如 CREATE USER、GRANT 和 REVOKE。见 第 15.7.1 节，“账户管理语句”。To control which users can connect, each account can be assigned authentication credentials such as a password. The user interface to MySQL accounts consists of SQL statements such as CREATE USER, GRANT, and REVOKE. See Section 15.7.1, “Account Management Statements”.

MySQL 权限系统确保所有用户只能执行允许他们进行的操作。作为用户，当你连接到 MySQL 服务器时，你的身份由 你连接的主机 和 你指定的用户名 确定。当你连接后发出请求时，系统会根据你的身份和 你想要执行的操作 授予权限。The MySQL privilege system ensures that all users may perform only the operations permitted to them. As a user, when you connect to a MySQL server, your identity is determined by the host from which you connect and the user name you specify. When you issue requests after connecting, the system grants privileges according to your identity and what you want to do.

MySQL 在识别用户时会同时考虑您的主机名和用户名，因为没有理由认为某个特定的用户名在所有主机上属于同一个人。例如，从 office.example.com 连接的用户 joe 不一定与从 home.example.com 连接的用户 joe 是同一个人。MySQL 处理这个问题的方法是允许您区分在不同主机上恰好具有相同名称的用户：您可以为从 office.example.com 连接的 joe 授予一组权限，而为从 home.example.com 连接的 joe 授予另一组权限。要查看某个账户拥有的权限，请使用 SHOW GRANTS 语句。例如：MySQL considers both your host name and user name in identifying you because there is no reason to assume that a given user name belongs to the same person on all hosts. For example, the user joe who connects from office.example.com need not be the same person as the user joe who connects from home.example.com. MySQL handles this by enabling you to distinguish users on different hosts that happen to have the same name: You can grant one set of privileges for connections by joe from office.example.com, and a different set of privileges for connections by joe from home.example.com. To see what privileges a given account has, use the SHOW GRANTS statement. For example:

SHOW GRANTS FOR 'joe'@'office.example.com';
SHOW GRANTS FOR 'joe'@'home.example.com';

在内部，服务器将权限信息存储在 mysql 系统数据库的授权表中。MySQL 服务器在启动时将这些表的内容读取到内存中，并根据内存中授权表的副本作出访问控制决定。Internally, the server stores privilege information in the grant tables of the mysql system database. The MySQL server reads the contents of these tables into memory when it starts and bases access-control decisions on the in-memory copies of the grant tables.

当你运行连接到服务器的客户端程序时，MySQL 访问控制涉及两个阶段：MySQL access control involves two stages when you run a client program that connects to the server:

阶段 1： 服务器根据您的身份以及您是否能够通过提供正确的密码验证您的身份来接受或拒绝连接。Stage 1: The server accepts or rejects the connection based on your identity and whether you can verify your identity by supplying the correct password.

阶段 2： 假设您可以连接，服务器会检查您发出的每条语句，以确定您是否具有执行该语句的足够权限。例如，如果您尝试从数据库中的表中选择行或从数据库中删除表，服务器会验证您是否具有该表的 SELECT 权限或数据库的 DROP 权限。Stage 2: Assuming that you can connect, the server checks each statement you issue to determine whether you have sufficient privileges to perform it. For example, if you try to select rows from a table in a database or drop a table from the database, the server verifies that you have the SELECT privilege for the table or the DROP privilege for the database.

有关每个阶段发生情况的更详细描述，请参见第 8.2.6 节，“访问控制，第 1 阶段：连接验证”，以及第 8.2.7 节，“访问控制，第 2 阶段：请求验证”。有关诊断与权限相关的问题的帮助，请参见第 8.2.22 节，“排查连接 MySQL 问题”。For a more detailed description of what happens during each stage, see Section 8.2.6, “Access Control, Stage 1: Connection Verification”, and Section 8.2.7, “Access Control, Stage 2: Request Verification”. For help in diagnosing privilege-related problems, see Section 8.2.22, “Troubleshooting Problems Connecting to MySQL”.

如果您的权限在连接期间被更改（无论是您自己还是其他人），这些更改不一定会立即对您发出的下一条语句生效。有关服务器重新加载授权表的条件的详细信息，请参见 第 8.2.13 节，“权限更改生效时间”。If your privileges are changed (either by yourself or someone else) while you are connected, those changes do not necessarily take effect immediately for the next statement that you issue. For details about the conditions under which the server reloads the grant tables, see Section 8.2.13, “When Privilege Changes Take Effect”.

使用 MySQL 权限系统，有一些事情是你无法做到的：There are some things that you cannot do with the MySQL privilege system: