How are permissions implemented in mysql

According to MySQL 5.7 Documentation under Privileges Provided by MySQL

The privileges granted to a MySQL account determine which operations the account can perform. MySQL privileges differ in the contexts in which they apply and at different levels of operation:

  • Administrative privileges enable users to manage operation of the MySQL server. These privileges are global because they are not specific to a particular database.

  • Database privileges apply to a database and to all objects within it. These privileges can be granted for specific databases, or globally so that they apply to all databases.

  • Privileges for database objects such as tables, indexes, views, and stored routines can be granted for specific objects within a database, for all objects of a given type within a database (for example, all tables in a database), or globally for all objects of a given type in all databases.

From this, the order is:

  • Global Privileges
  • Database Privileges
  • Table Privileges

The tables that drive the order are:

  • mysql.user
  • mysql.db
  • mysql.tables_priv
  • mysql.columns_priv

With regard to an identical username @ host, please note what pages 486,487 state about mysql's authentication algorithm from MySQL 5.0 Certification Study Guide

How are permissions implemented in mysql

There are two stages of client access control:

In the first stage, a client attempts to connect and the server either accepts or rejects the connection. For the attempt to succeed, some entry in the user table must match the host from which the client connects, the username, and the password.

In the second stage (which occurs only if a client has already connected sucessfully), the server checks every query it receives from the client to see whether the client has sufficient privileges to execute it.

The server matches a client against entries in the grant tables based on the host from which the client connects and the user the client provides. However, it's possible for more than one record to match:

Host values in grant tables may be specified as patterns contains wildcard values. If a grant table contains entries from,,, and %, all of them match a client who connects from

Patterns are not allowed for the User values in grant table entries, but a username may be given as an empty string to specify an anonymous user. The empty string matches any username and thus effectively acts as a wildcard.

When the Host and the User values in more than one user table record match a client, the server must decide which one to use. It does this by sorting records with the most specific Host and User column values first, and choosing the matching record that occurs first in the sorted list, Sorting take place as follows:

In the Host Column, literal values such as localhost,, and sort ahead of values such as that have pattern characters in them. Pattern values are sorted according to how specific they are. For example, is more specific than, which is more specific than %.

In the User column, non-blank usernames sort ahead of blank usernames. That is, non-anonymous users sort ahead of anonymous users.

The server performs this sorting when it starts. It reads the grant tables into memory, sorts them, and uses the in-memory copies for access control.

When you look at these two perspectives, mysqld should always go top down when evaluating grants. Keep in mind that

  • GRANT SELECT ON Demo.table1 TO [email protected]; is stored in mysql.tables_priv
  • GRANT ALL PRIVILEGES ON Demo.* TO [email protected]; is stored in mysql.db
  • For more information, please see my older post Unable to remove permission for mysql.user


GRANT ALL PRIVILEGES ON Demo.* TO [email protected];


Since Plesk does not allow GRANT privileges to users via the Plesk Control Panel, you will need to create those permissions via the command line.

Advanced Support can help!

If you're having trouble with the steps in this article, additional assistance is available via Advanced Support, our premium services division. For more information on what Advanced Support can do for you, please click here.

Changing the grants on your "admin" user could potentially lock you out of your Plesk Control Panel. Should this happen please consult for additional help.

For official MySQL documentation, please refer to


  • You must have SSH access set up for root or a sudo user.
    • Connecting via SSH to your server
    • How do I enable root access to my DV?
    • Disabling SSH login for root user


This article is provided as a courtesy. Installing, configuring, and troubleshooting third-party applications is outside the scope of support provided by (mt) Media Temple. Please take a moment to review the Statement of Support.


For the purpose of this article, we are going to use the 'SELECT' privilege. All code provided are examples. You will want to make sure that you change:

  • database to the database name you are using.
  • username to your database user.
  • password to a strong password unique to that user. Please read our article: Strong Password Guidelines.

Start by logging into your server via SSH and logging into MySQL entering the following:

mysql -u admin -p`cat /etc/psa/.psa.shadow`

The prompt should now look like this:


Enter the following if the database user already exists.:

GRANT SELECT ON database.* TO [email protected]'localhost';

If you intend to create a brand new user, then run this:

GRANT SELECT ON database.* TO [email protected]'localhost' IDENTIFIED BY 'password';

To enable more options, you would separate them with a comma. So to enable SELECT, INSERT, and DELETE your syntax would look like this:

GRANT SELECT, INSERT, DELETE ON database TO [email protected]'localhost' IDENTIFIED BY 'password';

Once you have given the desired privileges for your user, you will need to run this command within the MySQL command prompt:


To see a list of the privileges that have been granted to a specific user:

select * from mysql.user where User='username';

This is a list of privileges that you can grant:

Privilege Meaning
ALL [PRIVILEGES] Sets all simple privileges except GRANT OPTION
ALTER Enables use of ALTER TABLE
DELETE Enables use of DELETE
DROP Enables use of DROP TABLE
EXECUTE Not implemented
INSERT Enables use of INSERT
LOCK TABLES Enables use of LOCK TABLES on tables for which you have the SELECT privilege
PROCESS Enables the user to see all processes with SHOW PROCESSLIST
REFERENCES Not implemented
RELOAD Enables use of FLUSH
REPLICATION CLIENT Enables the user to ask where slave or master servers are
REPLICATION SLAVE Needed for replication slaves (to read binary log events from the master)
SELECT Enables use of SELECT
SHUTDOWN Enables use of MySQLadmin shutdown
SUPER Enables use of CHANGE MASTER, KILL, PURGE MASTER LOGS, and SET GLOBAL statements, the MySQLadmin debug command; allows you to connect (once) even if max_connections is reached
UPDATE Enables use of UPDATE
USAGE Synonym for privileges
GRANT OPTION Enables privileges to be granted


  • MySQL 5.1 Reference Manual: GRANT Syntax

How are permissions implemented in MySQL database?

In MySQL, the user permissions are granted to the MySQL user account which determines operations that can be performed in the server. These user permissions may differ in the levels of privileges in which they are applied for several query executions.

How do I grant user privileges to user in MySQL?

Create a new MySQL user account mysql> CREATE USER 'local_user'@'localhost' IDENTIFIED BY 'password'; This command will allow the user with username local_user to access the MySQL instance from the local machine (localhost) and prevent the user from accessing it directly from any other machine.

How do I show user permissions in MySQL?

MySQL Show User Privileges.
Access to the command line/terminal. MySQL installed and configured. ... .
Locate the exact username and host for the next step. ... .
Without a hostname, the command checks for the default host '%' . ... .
The output prints a table with all the access privileges..

How the privilege system works in MySQL where is access information stored?

Privilege-Granting Guidelines FILE can be abused to read into a database table any files that the MySQL server can read on the server host. This includes all world-readable files and files in the server's data directory. The table can then be accessed using SELECT to transfer its contents to the client host.