Documentation Home

6.2.4 指定账户名

MySQL 帐户名由用户名和主机名组成,这使得从不同主机连接的具有相同用户名的用户可以创建不同的帐户。本节介绍帐户名称的语法,包括特殊值和通配符规则。

帐户名称出现在 SQL 语句中,例如 CREATE USERGRANTSET PASSWORD并遵循以下规则:

  • 帐户名语法是 . 'user_name'@'host_name'

  • 该 部分是可选的。仅由用户名组成的帐户名等同于 . 例如,相当于 . @'host_name''user_name'@'%''me''me'@'%'

  • 如果用户名和主机名作为未加引号的标识符是合法的,则不需要加引号。user_name如果字符串包含特殊字符(例如空格或-),或者 host_name字符串包含特殊字符或通配符(例如 .或),则必须使用引号 %。例如,在 account name'test-user'@'%.com'中,用户名和主机名部分都需要引号。

  • 使用反引号 ( `)、单引号 ( ') 或双引号 ( ") 将用户名和主机名作为标识符或字符串引用。有关字符串引用和标识符引用指南,请参阅 第 9.1.1 节,“字符串文字”第 9.2 节,“模式对象名称”

  • 如果引用用户名和主机名部分,则必须单独引用。即写 'me'@'localhost',不 写'me@localhost'。后者实际上相当于'me@localhost'@'%'.

  • CURRENT_USER 对or函数 的引用CURRENT_USER()等同于按字面指定当前客户端的用户名和主机名。

MySQL 将帐户名存储在 mysql系统数据库的授权表中,使用单独的列作为用户名和主机名部分:

  • user表包含每个帐户一行。和列存储用户名和主机名UserHost此表还指示该帐户具有哪些全局权限。

  • 其他授权表指示帐户对数据库和数据库中的对象具有的权限。这些表有 UserHost列来存储帐户名称。user这些表中的每一行都与表中具有相同UserHost 值 的帐户相关联。

  • 出于访问检查目的,用户值的比较区分大小写。主机值的比较不区分大小写。

有关存储在授权表中的用户名和主机名属性的更多详细信息,例如最大长度,请参阅 授权表范围列属性

用户名和主机名具有某些特殊值或通配符约定,如下所述。

帐户名的用户名部分要么是一个与传入连接尝试的用户名字面匹配的非空值,要么是一个与任何用户名匹配的空值(空字符串)。具有空白用户名的帐户是匿名用户。要在 SQL 语句中指定匿名用户,请使用带引号的空用户名部分,例如''@'localhost'.

帐户名的主机名部分可以采用多种形式,并且允许使用通配符:

  • A host value can be a host name or an IP address (IPv4 or IPv6). The name 'localhost' indicates the local host. The IP address '127.0.0.1' indicates the IPv4 loopback interface. The IP address '::1' indicates the IPv6 loopback interface.

  • The % and _ wildcard characters are permitted in host name or IP address values. These have the same meaning as for pattern-matching operations performed with the LIKE operator. For example, a host value of '%' matches any host name, whereas a value of '%.mysql.com' matches any host in the mysql.com domain. '198.51.100.%' matches any host in the 198.51.100 class C network.

    Because IP wildcard values are permitted in host values (for example, '198.51.100.%' to match every host on a subnet), someone could try to exploit this capability by naming a host 198.51.100.somewhere.com. To foil such attempts, MySQL does not perform matching on host names that start with digits and a dot. For example, if a host is named 1.2.example.com, its name never matches the host part of account names. An IP wildcard value can match only IP addresses, not host names.

  • For a host value specified as an IPv4 address, a netmask can be given to indicate how many address bits to use for the network number. Netmask notation cannot be used for IPv6 addresses.

    The syntax is host_ip/netmask. For example:

    CREATE USER 'david'@'198.51.100.0/255.255.255.0';

    This enables david to connect from any client host having an IP address client_ip for which the following condition is true:

    client_ip & netmask = host_ip

    That is, for the CREATE USER statement just shown:

    client_ip & 255.255.255.0 = 198.51.100.0

    IP addresses that satisfy this condition range from 198.51.100.0 to 198.51.100.255.

    A netmask typically begins with bits set to 1, followed by bits set to 0. Examples:

    • 198.0.0.0/255.0.0.0: Any host on the 198 class A network

    • 198.51.0.0/255.255.0.0: Any host on the 198.51 class B network

    • 198.51.100.0/255.255.255.0: Any host on the 198.51.100 class C network

    • 198.51.100.1: Only the host with this specific IP address

The server performs matching of host values in account names against the client host using the value returned by the system DNS resolver for the client host name or IP address. Except in the case that the account host value is specified using netmask notation, the server performs this comparison as a string match, even for an account host value given as an IP address. This means that you should specify account host values in the same format used by DNS. Here are examples of problems to watch out for:

  • 假设本地网络上的主机具有完全限定名称host1.example.com. 如果 DNS 将此主机的名称查找返回为 host1.example.com,请在帐户主机值中使用该名称。如果 DNS 仅返回host1,请 host1改用。

  • 如果 DNS 返回给定主机的 IP 地址为 198.51.100.2,则匹配帐户主机值198.51.100.2但不 匹配198.051.100.2。同样,它匹配一个帐户主机模式,如198.51.100.%但不是198.051.100.%

为避免此类问题,建议检查 DNS 返回主机名和地址的格式。在 MySQL 帐户名中使用相同格式的值。