如果您拥有 SET_ANY_DEFINER 权限，您可以将任何账户指定为 DEFINER 属性。如果该账户不存在，将生成一个警告。此外，要将存储对象的 DEFINER 属性设置为拥有 SYSTEM_USER 权限的账户，您必须拥有 SYSTEM_USER 权限。If you have the SET_ANY_DEFINER privilege, you can specify any account as the DEFINER attribute. If the account does not exist, a warning is generated. Additionally, to set a stored object DEFINER attribute to an account that has the SYSTEM_USER privilege, you must have the SYSTEM_USER privilege.

否则，唯一允许的账户是您自己的账户，可以通过文字方式指定，或使用 CURRENT_USER 或 CURRENT_USER()。您不能将定义者设置为其他账户。Otherwise, the only permitted account is your own, specified either literally or as CURRENT_USER or CURRENT_USER(). You cannot set the definer to any other account.

在定义者安全上下文中执行的存储对象以其 DEFINER 属性所指定帐户的权限执行。这些权限可能与调用用户的权限完全不同。调用者必须具有适当的权限才能引用该对象（例如，调用存储过程需要 EXECUTE 权限，从视图中选择数据需要 SELECT 权限），但在对象执行期间，调用者的权限会被忽略，仅 DEFINER 帐户的权限才起作用。如果 DEFINER 帐户的权限较少，则对象能执行的操作同样受到限制。如果 DEFINER 帐户权限很高（例如管理帐户），则该对象可以执行强大的操作 无论谁调用它。A stored object that executes in definer security context executes with the privileges of the account named by its DEFINER attribute. These privileges may be entirely different from those of the invoking user. The invoker must have appropriate privileges to reference the object (for example, EXECUTE to call a stored procedure or SELECT to select from a view), but during object execution, the invoker's privileges are ignored and only the DEFINER account privileges matter. If the DEFINER account has few privileges, the object is correspondingly limited in the operations it can perform. If the DEFINER account is highly privileged (such as an administrative account), the object can perform powerful operations no matter who invokes it.

在调用者安全上下文中执行的存储例程或视图只能执行调用者具有权限的操作。DEFINER 属性对对象的执行没有影响。A stored routine or view that executes in invoker security context can perform only operations for which the invoker has privileges. The DEFINER attribute has no effect on object execution.

可以在创建对象时通过指定一个不存在的 DEFINER 账户来创建孤立存储对象。An orphan stored object can be created by specifying a nonexistent DEFINER account at object-creation time.

已存在的存储对象可以通过执行 DROP USER 语句删除对象的 DEFINER 账户，或者通过 RENAME USER 语句重命名对象的 DEFINER 账户，从而变为孤立。An existing stored object can become orphaned through execution of a DROP USER statement that drops the object DEFINER account, or a RENAME USER statement that renames the object DEFINER account.

由于 DEFINER 账户不存在，如果对象在定义者安全上下文中执行，可能无法按预期工作：Because the DEFINER account does not exist, the object may not work as expected if it executes in definer security context:

如果随后为与对象无关的用途重新创建不存在的 DEFINER 帐户，则该对象可能会存在安全风险。在这种情况下，该帐户“采用”该对象，并且在具有相应权限的情况下，即使不是出于本意，也能够执行它。The object may present a security risk if the nonexistent DEFINER account is subsequently re-created for a purpose unrelated to the object. In this case, the account “adopts” the object and, with the appropriate privileges, is able to execute it even if that is not intended.

DROP USER 如果要删除的任何帐户被命名为任何存储对象的 DEFINER 属性，则会报错失败。（也就是说，如果删除帐户会导致存储对象成为孤立对象，则语句会失败。）DROP USER fails with an error if any account to be dropped is named as the DEFINER attribute for any stored object. (That is, the statement fails if dropping an account would cause a stored object to become orphaned.)

RENAME USER 如果任何要重命名的账户被指定为任何存储对象的 DEFINER 属性，则会出错。（也就是说，如果重命名账户会导致某个存储对象变成孤立对象，则语句会失败。）RENAME USER fails with an error if any account to be renamed is named as the DEFINER attribute for any stored object. (That is, the statement fails if renaming an account would cause a stored object to become orphaned.)

CREATE USER 如果任何要创建的账户被指定为任何存储对象的 DEFINER 属性，则会出错。（也就是说，如果创建账户会导致该账户采用当前孤立的存储对象，则语句会失败。）CREATE USER fails with an error if any account to be created is named as the DEFINER attribute for any stored object. (That is, the statement fails if creating an account would cause the account to adopt a currently orphaned stored object.)

要确定每个表中存在哪些 DEFINER 值，请使用以下查询：To identify which DEFINER values exist in each table, use these queries:

SELECT DISTINCT DEFINER FROM INFORMATION_SCHEMA.EVENTS;
SELECT DISTINCT DEFINER FROM INFORMATION_SCHEMA.ROUTINES;
SELECT DISTINCT DEFINER FROM INFORMATION_SCHEMA.TRIGGERS;
SELECT DISTINCT DEFINER FROM INFORMATION_SCHEMA.VIEWS;

查询结果对于如下显示的任何账户都很重要：The query results are significant for any account displayed as follows:

要使用不同的定义者重新定义对象，可以使用 ALTER EVENT 或 ALTER VIEW 直接修改事件和视图的 DEFINER 账户。对于存储过程、函数和触发器，必须删除该对象并重新创建以分配不同的 DEFINER 账户To redefine an object with a different definer, you can use ALTER EVENT or ALTER VIEW to directly modify the DEFINER account of events and views. For stored procedures and functions and for triggers, you must drop the object and re-create it to assign a different DEFINER account

要识别具有特定 DEFINER 账户的对象，请使用这些查询，并将感兴趣的账户替换为 user_name@host_name：To identify which objects have a given DEFINER account, use these queries, substituting the account of interest for user_name@host_name:

SELECT EVENT_SCHEMA, EVENT_NAME FROM INFORMATION_SCHEMA.EVENTS
WHERE DEFINER = 'user_name@host_name';
SELECT ROUTINE_SCHEMA, ROUTINE_NAME, ROUTINE_TYPE
FROM INFORMATION_SCHEMA.ROUTINES
WHERE DEFINER = 'user_name@host_name';
SELECT TRIGGER_SCHEMA, TRIGGER_NAME FROM INFORMATION_SCHEMA.TRIGGERS
WHERE DEFINER = 'user_name@host_name';
SELECT TABLE_SCHEMA, TABLE_NAME FROM INFORMATION_SCHEMA.VIEWS
WHERE DEFINER = 'user_name@host_name';

对于 ROUTINES 表，查询包括 ROUTINE_TYPE 列，以便输出行可以区分 DEFINER 是用于存储过程还是存储函数。For the ROUTINES table, the query includes the ROUTINE_TYPE column so that output rows distinguish whether the DEFINER is for a stored procedure or stored function.

如果您正在搜索的账户不存在，那么这些查询显示的任何对象都是孤立对象。If the account you are searching for does not exist, any objects displayed by those queries are orphan objects.

不要创建孤立的存储对象；也就是说，不要创建DEFINER属性指定的账户不存在的对象。不要通过删除或重命名任何现有对象的DEFINER属性所指定的账户而导致存储对象变为孤立。Do not create orphan stored objects; that is, objects for which the DEFINER attribute names a nonexistent account. Do not cause stored objects to become orphaned by dropping or renaming an account named by the DEFINER attribute of any existing object.

对于存储例程或视图，如果可能，在对象定义中使用SQL SECURITY INVOKER，这样只有具有执行对象操作的适当权限的用户才能使用它。For a stored routine or view, use SQL SECURITY INVOKER in the object definition when possible so that it can be used only by users with permissions appropriate for the operations performed by the object.

如果您在使用具有SET_ANY_DEFINER权限的账户创建定义者上下文存储对象时，请指定一个明确的DEFINER属性，该属性指向仅拥有执行对象所需操作权限的账户。仅在绝对必要时才指定权限很高的DEFINER账户。If you create definer-context stored objects while using an account that has the SET_ANY_DEFINER privilege, specify an explicit DEFINER attribute that names an account possessing only the privileges required for the operations performed by the object. Specify a highly privileged DEFINER account only when absolutely necessary.

管理员可以通过不授予用户SET_ANY_DEFINER权限，来防止用户创建指定高权限DEFINER账户的存储对象。Administrators can prevent users from creating stored objects that specify highly privileged DEFINER accounts by not granting them the SET_ANY_DEFINER privilege.

定义者上下文对象的编写应考虑到它们可能能够访问调用用户没有权限的数据。在某些情况下，您可以通过不授予未授权用户特定权限来防止引用这些对象：Definer-context objects should be written keeping in mind that they may be able to access data for which the invoking user has no privileges. In some cases, you can prevent references to these objects by not granting unauthorized users particular privileges:

然而，由于触发器和事件始终在定义者上下文中执行，因此不存在这样的控制。服务器会根据需要自动调用这些对象，用户不会直接引用它们：However, no such control exists for triggers and events because they always execute in definer context. The server invokes these objects automatically as necessary, and users do not reference them directly:

在这两种情况下，如果 DEFINER 账户具有高权限，该对象可能能够执行敏感或危险的操作。即使创建对象所需的权限已从创建该对象的用户账户中撤销，这仍然成立。管理员在授予用户对象创建权限时应特别谨慎。In both cases, if the DEFINER account is highly privileged, the object may be able to perform sensitive or dangerous operations. This remains true if the privileges needed to create the object are revoked from the account of the user who created it. Administrators should be especially careful about granting users object-creation privileges.

默认情况下，当执行具有 SQL SECURITY DEFINER时，MySQL 服务器不会为 DEFINER，只设置默认角色。例外情况是，如果系统变量启用了 activate_all_roles_on_login 服务器会设置所有授予 DEFINER 用户的角色，包括强制角色。因此，当CREATE PROCEDURE“或 CREATE FUNCTION 语句时，默认不会被检查。对于存储程序，如果执行角色与默认不同，程序本体可以执行 SET ROLE”来激活所需角色。此操作需谨慎，因为分配给角色的权限可能会被更改。By default, when a routine with the SQL SECURITY DEFINER characteristic is executed, MySQL Server does not set any active roles for the MySQL account named in the DEFINER clause, only the default roles. The exception is if the activate_all_roles_on_login system variable is enabled, in which case MySQL Server sets all roles granted to the DEFINER user, including mandatory roles. Any privileges granted through roles are therefore not checked by default when the CREATE PROCEDURE or CREATE FUNCTION statement is issued. For stored programs, if execution should occur with roles different from the default, the program body can execute SET ROLE to activate the required roles. This must be done with caution since the privileges assigned to roles can be changed.