在服务器接受连接后，它会进入访问控制的第二阶段。对于通过该连接发出的每个请求，服务器会确定您想执行的操作，然后检查您的权限是否足够。这就是授权表中的权限列发挥作用的地方。这些权限可以来自 user、global_grants、db、tables_priv、columns_priv 或 procs_priv 表中的任何一个。（您可能会发现参考 第 8.2.3 节，“授权表” 会很有帮助，其中列出了每个授权表中存在的列。）After the server accepts a connection, it enters Stage 2 of access control. For each request that you issue through the connection, the server determines what operation you want to perform, then checks whether your privileges are sufficient. This is where the privilege columns in the grant tables come into play. These privileges can come from any of the user, global_grants, db, tables_priv, columns_priv, or procs_priv tables. (You may find it helpful to refer to Section 8.2.3, “Grant Tables”, which lists the columns present in each grant table.)

user 和 global_grants 表授予全局权限。这些表中针对特定账户的行表示该账户的权限在全局范围内适用，无论默认数据库是什么。例如，如果 user 表授予你 DELETE 权限，你可以删除服务器主机上任何数据库中任何表的行。明智的做法是只将 user 表中的权限授予那些真正需要的人，例如数据库管理员。对于其他用户，应将 user 表中的所有权限设置为 'N'，并仅在更具体的层级（例如特定数据库、表、列或存储过程）授予权限。也可以在全局范围内授予数据库权限，但使用部分撤销来限制它们在特定数据库上的使用（参见 第 8.2.12 节，“使用部分撤销限制权限”）。The user and global_grants tables grant global privileges. The rows in these tables for a given account indicate the account privileges that apply on a global basis no matter what the default database is. For example, if the user table grants you the DELETE privilege, you can delete rows from any table in any database on the server host. It is wise to grant privileges in the user table only to people who need them, such as database administrators. For other users, leave all privileges in the user table set to 'N' and grant privileges at more specific levels only (for particular databases, tables, columns, or routines). It is also possible to grant database privileges globally but use partial revokes to restrict them from being exercised on specific databases (see Section 8.2.12, “Privilege Restriction Using Partial Revokes”).

db 表授予特定于数据库的权限。该表中 scope 列的值可以采取以下形式：The db table grants database-specific privileges. Values in the scope columns of this table can take the following forms:

服务器在读取 user 表的同时，会将 db 表读入内存并进行排序。服务器根据 Host、Db 和 User 范围列对 db 表进行排序。与 user 表一样，排序会将最具体的值放在最前面，将最不具体的值放在最后，并且在服务器查找匹配行时，会使用找到的第一个匹配项。The server reads the db table into memory and sorts it at the same time that it reads the user table. The server sorts the db table based on the Host, Db, and User scope columns. As with the user table, sorting puts the most-specific values first and least-specific values last, and when the server looks for matching rows, it uses the first match that it finds.

tables_priv、columns_priv 和 procs_priv 表授予特定表、特定列和特定存储过程的权限。这些表中 scope 列的值可以采取以下形式：The tables_priv, columns_priv, and procs_priv tables grant table-specific, column-specific, and routine-specific privileges. Values in the scope columns of these tables can take the following forms:

服务器根据 Host、Db 和 User 列对 tables_priv、columns_priv 和 procs_priv 表进行排序。这类似于 db 表的排序，但更简单，因为只有 Host 列可以包含通配符。The server sorts the tables_priv, columns_priv, and procs_priv tables based on the Host, Db, and User columns. This is similar to db table sorting, but simpler because only the Host column can contain wildcards.

服务器使用排序表来验证它收到的每个请求。对于需要管理权限的请求，例如 SHUTDOWN 或 RELOAD，服务器仅检查 user 和 global_privilege 表，因为这些是唯一指定管理权限的表。如果这些表中该账号的行允许请求的操作，则服务器授予访问权限，否则拒绝访问。例如，如果你想执行 mysqladmin shutdown，但你的 user 表行未授予你 SHUTDOWN 权限，服务器会拒绝访问，甚至不检查 db 表。（后者表不包含 Shutdown_priv 列，因此无需检查它。）The server uses the sorted tables to verify each request that it receives. For requests that require administrative privileges such as SHUTDOWN or RELOAD, the server checks only the user and global_privilege tables because those are the only tables that specify administrative privileges. The server grants access if a row for the account in those tables permits the requested operation and denies access otherwise. For example, if you want to execute mysqladmin shutdown but your user table row does not grant the SHUTDOWN privilege to you, the server denies access without even checking the db table. (The latter table contains no Shutdown_priv column, so there is no need to check it.)

对于与数据库相关的请求（INSERT、UPDATE 等），服务器首先检查 user 表中用户的全局权限行（减去部分撤销所施加的权限限制）。如果该行允许请求的操作，则授予访问权限。如果 user 表中的全局权限不足，服务器会从 db 表确定用户的数据库特定权限：For database-related requests (INSERT, UPDATE, and so on), the server first checks the user's global privileges in the user table row (less any privilege restrictions imposed by partial revokes). If the row permits the requested operation, access is granted. If the global privileges in the user table are insufficient, the server determines the user's database-specific privileges from the db table:

在确定由 db 表行授予的数据库特定权限后，服务器会将它们添加到由 user 表授予的全局权限中。如果结果允许请求的操作，则授予访问权限。否则，服务器会依次检查 tables_priv 和 columns_priv 表中的用户表和列权限，将这些权限添加到用户权限中，并根据结果允许或拒绝访问。对于存储例程操作，服务器使用 procs_priv 表，而不是 tables_priv 和 columns_priv。After determining the database-specific privileges granted by the db table rows, the server adds them to the global privileges granted by the user table. If the result permits the requested operation, access is granted. Otherwise, the server successively checks the user's table and column privileges in the tables_priv and columns_priv tables, adds those to the user's privileges, and permits or denies access based on the result. For stored-routine operations, the server uses the procs_priv table rather than tables_priv and columns_priv.

用布尔术语表达，上述关于如何计算用户权限的描述可以总结如下：Expressed in boolean terms, the preceding description of how a user's privileges are calculated may be summarized like this:

global privileges
OR database privileges
OR table privileges
OR column privileges
OR routine privileges

如果在最初发现全局权限不足以执行请求的操作时，服务器随后会将这些权限添加到数据库、表和列权限中，这一行为的原因可能不太明显。原因在于一个请求可能需要多种类型的权限。例如，如果你执行一个 INSERT INTO ... SELECT 语句，你需要同时拥有 INSERT 和 SELECT 权限。你的权限可能是这样的：user 表的行授予了全局的其中一种权限，而 db 表的行则专门为相关数据库授予了另一种权限。在这种情况下，你拥有执行请求所需的权限，但服务器仅通过全局权限或数据库权限都无法判断这一点。它必须基于组合权限来做出访问控制决定。It may not be apparent why, if the global privileges are initially found to be insufficient for the requested operation, the server adds those privileges to the database, table, and column privileges later. The reason is that a request might require more than one type of privilege. For example, if you execute an INSERT INTO ... SELECT statement, you need both the INSERT and the SELECT privileges. Your privileges might be such that the user table row grants one privilege global and the db table row grants the other specifically for the relevant database. In this case, you have the necessary privileges to perform the request, but the server cannot tell that from either your global or database privileges alone. It must make an access-control decision based on the combined privileges.