MySQL 账户名由用户名和主机名组成,这使得可以为从不同主机连接的相同用户名的用户创建不同的账户。本节描述了账户名的语法,包括特殊值和通配符规则。MySQL account names consist of a user name and a host name, which enables creation of distinct accounts for users with the same user name who connect from different hosts. This section describes the syntax for account names, including special values and wildcard rules.
在大多数方面,帐户名与 MySQL 角色名相似,其差异在第 8.2.5 节,“指定角色名”中有所描述。In most respects, account names are similar to MySQL role names, with some differences described at Section 8.2.5, “Specifying Role Names”.
帐户名出现在 SQL 语句中,例如 CREATE USER、GRANT 以及 SET
PASSWORD 并遵循以下规则:Account names appear in SQL statements such as
CREATE USER,
GRANT, and SET
PASSWORD and follow these rules:
帐户名语法为
'。Account name syntax isuser_name'@'host_name''.user_name'@'host_name'@'部分是可选的。仅由用户名组成的账号名称等同于host_name''。例如,user_name'@'%''me'等同于'me'@'%'。The@'part is optional. An account name consisting only of a user name is equivalent tohost_name''. For example,user_name'@'%''me'is equivalent to'me'@'%'.如果用户名和主机名是合法的未加引号的标识符,则无需加引号。如果
user_name字符串包含特殊字符(例如空格或-),或者host_name字符串包含特殊字符或通配符(例如.或%),则必须使用引号。例如,在账号名称'test-user'@'%.com'中,用户名和主机名部分都需要加引号。The user name and host name need not be quoted if they are legal as unquoted identifiers. Quotes must be used if auser_namestring contains special characters (such as space or-), or ahost_namestring contains special characters or wildcard characters (such as.or%). For example, in the account name'test-user'@'%.com', both the user name and host name parts require quotes.将用户名和主机名作为标识符或字符串引用,可使用反引号(
`)、单引号(')或双引号(")。有关字符串引用和标识符引用的指南,请参见 第 11.1.1 节,“字符串字面值”,以及 第 11.2 节,“模式对象名称”。在SHOW语句结果中,用户名和主机名使用反引号(`)引用。Quote user names and host names as identifiers or as strings, using either backticks (`), single quotation marks ('), or double quotation marks ("). For string-quoting and identifier-quoting guidelines, see Section 11.1.1, “String Literals”, and Section 11.2, “Schema Object Names”. InSHOWstatement results, user names and host names are quoted using backticks (`).用户名和主机名部分,如果加引号,必须分别加引号。也就是说,写
'me'@'localhost',而不是'me@localhost'。(后者实际上相当于'me@localhost'@'%',尽管这种行为现在已被弃用。)The user name and host name parts, if quoted, must be quoted separately. That is, write'me'@'localhost', not'me@localhost'. (The latter is actually equivalent to'me@localhost'@'%', although this behavior is now deprecated.)引用
CURRENT_USER或CURRENT_USER()函数等同于字面指定当前客户端的用户名和主机名。A reference to theCURRENT_USERorCURRENT_USER()function is equivalent to specifying the current client's user name and host name literally.
MySQL 在 mysql 系统数据库的授权表中存储账户名,用户名和主机名部分使用单独的列:MySQL stores account names in grant tables in the
mysql system database using separate columns
for the user name and host name parts:
user表包含每个账户的一行记录。User和Host列存储用户名和主机名。此表还指示该账户拥有的全局权限。Theusertable contains one row for each account. TheUserandHostcolumns store the user name and host name. This table also indicates which global privileges the account has.其他授权表指示账户对数据库及数据库内对象拥有的权限。这些表具有
User和Host列来存储账户名称。这些表中的每一行都与user表中具有相同User和Host值的账户相关联。Other grant tables indicate privileges an account has for databases and objects within databases. These tables haveUserandHostcolumns to store the account name. Each row in these tables associates with the account in theusertable that has the sameUserandHostvalues.出于访问检查的目的,用户值的比较是区分大小写的。主机值的比较不区分大小写。For access-checking purposes, comparisons of User values are case-sensitive. Comparisons of Host values are not case-sensitive.
有关存储在授权表中的用户名和主机名属性的更多详细信息,例如最大长度,请参阅授权表范围列属性。For additional detail about the properties of user names and host names as stored in the grant tables, such as maximum length, see Grant Table Scope Column Properties.
用户名和主机名具有某些特殊值或通配符约定,如下所述。User names and host names have certain special values or wildcard conventions, as described following.
账户名中的用户名部分要么是一个非空值,与传入连接尝试的用户名完全匹配,要么是空值(空字符串),可以匹配任何用户名。用户名为空的账户为匿名用户。要在 SQL 语句中指定匿名用户,请使用带引号的空用户名部分,例如 ''@'localhost'。The user name part of an account name is either a nonblank value
that literally matches the user name for incoming connection
attempts, or a blank value (the empty string) that matches any
user name. An account with a blank user name is an anonymous user.
To specify an anonymous user in SQL statements, use a quoted empty
user name part, such as ''@'localhost'.
帐户名的主机名部分可以采用多种形式,并允许使用通配符:The host name part of an account name can take many forms, and wildcards are permitted:
主机值可以是主机名或 IP 地址(IPv4 或 IPv6)。名称
'localhost'表示本地主机。IP 地址'127.0.0.1'表示 IPv4 回环接口。IP 地址'::1'表示 IPv6 回环接口。A host value can be a host name or an IP address (IPv4 or IPv6). The name'localhost'indicates the local host. The IP address'127.0.0.1'indicates the IPv4 loopback interface. The IP address'::1'indicates the IPv6 loopback interface.在主机名或 IP 地址值中允许使用
%和_通配符字符,但这些字符已被弃用,因此将在未来版本的 MySQL 中可能被移除。这些字符的含义与使用LIKE运算符进行模式匹配操作时相同。例如,主机值'%'匹配任何主机名,而值'%.mysql.com'匹配mysql.com域中的任何主机。'198.51.100.%'匹配 198.51.100 C 类网络中的任何主机。Use of the%and_wildcard characters is permitted in host name or IP address values, but is deprecated and thus subject to removal in a future version of MySQL. These characters have the same meaning as for pattern-matching operations performed with theLIKEoperator. For example, a host value of'%'matches any host name, whereas a value of'%.mysql.com'matches any host in themysql.comdomain.'198.51.100.%'matches any host in the 198.51.100 class C network.因为在主机值中允许使用 IP 通配符值(例如,
'198.51.100.%'可以匹配一个子网内的所有主机),有人可能会尝试通过将主机命名为198.51.100.somewhere.com来利用此功能。为了防止此类尝试,MySQL 不会对以数字和点开头的主机名进行匹配。例如,如果主机名为1.2.example.com,其名称永远不会与帐户名的主机部分匹配。IP 通配符值只能匹配 IP 地址,而不能匹配主机名。Because IP wildcard values are permitted in host values (for example,'198.51.100.%'to match every host on a subnet), someone could try to exploit this capability by naming a host198.51.100.somewhere.com. To foil such attempts, MySQL does not perform matching on host names that start with digits and a dot. For example, if a host is named1.2.example.com, its name never matches the host part of account names. An IP wildcard value can match only IP addresses, not host names.如果
partial_revokes为ON,MySQL 会将授权中的%和_视为字面字符,而不是通配符。这些通配符的使用已被弃用(无论此变量的值如何);您应该预期此功能将在未来的 MySQL 版本中被移除。Ifpartial_revokesisON, MySQL treats%and_in grants as literal characters, and not as wildcards. Use of these wildcards is deprecated (regardless of this variable's value); you should expect this functionality to be removed in a future version of MySQL.对于指定为 IPv4 地址的主机值,可以提供子网掩码以指示要用于网络号的地址位数。子网掩码表示法不能用于 IPv6 地址。For a host value specified as an IPv4 address, a netmask can be given to indicate how many address bits to use for the network number. Netmask notation cannot be used for IPv6 addresses.
语法是
。例如:The syntax ishost_ip/netmask. For example:host_ip/netmaskCREATE USER 'david'@'198.51.100.0/255.255.255.0';
这使得
david可以从任何具有 IP 地址client_ip的客户端主机连接,只要满足以下条件:This enablesdavidto connect from any client host having an IP addressclient_ipfor which the following condition is true:client_ip&netmask=host_ip也就是说,对于刚才显示的
CREATE USER语句:That is, for theCREATE USERstatement just shown:client_ip& 255.255.255.0 = 198.51.100.0满足此条件的 IP 地址范围是从
198.51.100.0到198.51.100.255。IP addresses that satisfy this condition range from198.51.100.0to198.51.100.255.子网掩码通常以设置为 1 的位开头,随后是设置为 0 的位。例如:A netmask typically begins with bits set to 1, followed by bits set to 0. Examples:
198.0.0.0/255.0.0.0:198 类 A 网络上的任何主机198.0.0.0/255.0.0.0: Any host on the 198 class A network198.51.0.0/255.255.0.0:198.51 类 B 网络上的任何主机198.51.0.0/255.255.0.0: Any host on the 198.51 class B network198.51.100.0/255.255.255.0:198.51.100 类 C 网络上的任何主机198.51.100.0/255.255.255.0: Any host on the 198.51.100 class C network198.51.100.1:只有具有此特定 IP 地址的主机198.51.100.1: Only the host with this specific IP address
以 IPv4 地址指定的主机值可以使用 CIDR 表示法书写,例如
198.51.100.44/24。A host value specified as an IPv4 address can be written using CIDR notation, such as198.51.100.44/24.
服务器将帐户名称中的主机值与客户端主机进行匹配,使用系统 DNS 解析器返回的客户端主机名或 IP 地址的值。除非帐户主机值是使用网络掩码表示的,否则服务器将此比较作为字符串匹配进行,即使帐户主机值以 IP 地址形式给出。这意味着你应当以 DNS 使用的相同格式指定帐户主机值。以下是需要注意的问题示例:The server performs matching of host values in account names against the client host using the value returned by the system DNS resolver for the client host name or IP address. Except in the case that the account host value is specified using netmask notation, the server performs this comparison as a string match, even for an account host value given as an IP address. This means that you should specify account host values in the same format used by DNS. Here are examples of problems to watch out for:
假设本地网络上的主机完全限定名为
host1.example.com。如果 DNS 返回该主机的名称查询结果为host1.example.com,请在账户主机值中使用该名称。如果 DNS 仅返回host1,则使用host1。Suppose that a host on the local network has a fully qualified name ofhost1.example.com. If DNS returns name lookups for this host ashost1.example.com, use that name in account host values. If DNS returns justhost1, usehost1instead.如果 DNS 返回某个主机的 IP 地址为
198.51.100.2,则它匹配账户主机值198.51.100.2,但不匹配198.051.100.2。同样,它匹配账户主机模式如198.51.100.%,但不匹配198.051.100.%。If DNS returns the IP address for a given host as198.51.100.2, that matches an account host value of198.51.100.2but not198.051.100.2. Similarly, it matches an account host pattern like198.51.100.%but not198.051.100.%.
为了避免此类问题,建议检查您的 DNS 返回主机名和地址的格式。在 MySQL 帐户名中使用相同格式的值。To avoid problems like these, it is advisable to check the format in which your DNS returns host names and addresses. Use values in the same format in MySQL account names.