如果我们只能使用 root 用户，这样存在安全隐患。这时，就需要使用 MySQL 的用户管理。
1. 用户
1.1 用户信息
sql
mysql> show databases;
+--------------------+
| Database |
+--------------------+
| d1 |
| information_schema |
| mysql | <--用户信息所在的数据库
| oj_system |
| performance_schema |
| scott |
| store |
| sys |
| test_db |
| users |
+--------------------+
10 rows in set (0.00 sec)
mysql> use mysql
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A
Database changed
mysql> select host,user,authentication_string from user;
+-----------+------------------+------------------------------------------------------------------------+
| host | user | authentication_string |
+-----------+------------------+------------------------------------------------------------------------+
| localhost | debian-sys-maint | $A$005$
AD?>}~YyXG9covU8bmtohEsua4r2L8vDbyQciW5GhvAS89XcJdaQGa3 |
| localhost | mysql.infoschema | $A$005$THISISACOMBINATIONOFINVALIDSALTANDPASSWORDTHATMUSTNEVERBRBEUSED |
| localhost | mysql.session | $A$005$THISISACOMBINATIONOFINVALIDSALTANDPASSWORDTHATMUSTNEVERBRBEUSED |
| localhost | mysql.sys | $A$005$THISISACOMBINATIONOFINVALIDSALTANDPASSWORDTHATMUSTNEVERBRBEUSED |
| localhost | root | |
| localhost | wsj | |
+-----------+------------------+------------------------------------------------------------------------+
6 rows in set (0.00 sec)user 表的表结构：
sql
mysql> desc user;
+--------------------------+-----------------------------------+------+-----+-----------------------+-------+
| Field | Type | Null | Key | Default | Extra |
+--------------------------+-----------------------------------+------+-----+-----------------------+-------+
| Host | char(255) | NO | PRI | | |
| User | char(32) | NO | PRI | | |
| Select_priv | enum('N','Y') | NO | | N | |
| Insert_priv | enum('N','Y') | NO | | N | |
| Update_priv | enum('N','Y') | NO | | N | |
| Delete_priv | enum('N','Y') | NO | | N | |
| Create_priv | enum('N','Y') | NO | | N | |
| Drop_priv | enum('N','Y') | NO | | N | |
| Reload_priv | enum('N','Y') | NO | | N | |
| Shutdown_priv | enum('N','Y') | NO | | N | |
| Process_priv | enum('N','Y') | NO | | N | |
| File_priv | enum('N','Y') | NO | | N | |
| Grant_priv | enum('N','Y') | NO | | N | |
| References_priv | enum('N','Y') | NO | | N | |
| Index_priv | enum('N','Y') | NO | | N | |
| Alter_priv | enum('N','Y') | NO | | N | |
| Show_db_priv | enum('N','Y') | NO | | N | |
| Super_priv | enum('N','Y') | NO | | N | |
| Create_tmp_table_priv | enum('N','Y') | NO | | N | |
| Lock_tables_priv | enum('N','Y') | NO | | N | |
| Execute_priv | enum('N','Y') | NO | | N | |
| Repl_slave_priv | enum('N','Y') | NO | | N | |
| Repl_client_priv | enum('N','Y') | NO | | N | |
| Create_view_priv | enum('N','Y') | NO | | N | |
| Show_view_priv | enum('N','Y') | NO | | N | |
| Create_routine_priv | enum('N','Y') | NO | | N | |
| Alter_routine_priv | enum('N','Y') | NO | | N | |
| Create_user_priv | enum('N','Y') | NO | | N | |
| Event_priv | enum('N','Y') | NO | | N | |
| Trigger_priv | enum('N','Y') | NO | | N | |
| Create_tablespace_priv | enum('N','Y') | NO | | N | |
| ssl_type | enum('','ANY','X509','SPECIFIED') | NO | | | |
| ssl_cipher | blob | NO | | NULL | |
| x509_issuer | blob | NO | | NULL | |
| x509_subject | blob | NO | | NULL | |
| max_questions | int unsigned | NO | | 0 | |
| max_updates | int unsigned | NO | | 0 | |
| max_connections | int unsigned | NO | | 0 | |
| max_user_connections | int unsigned | NO | | 0 | |
| plugin | char(64) | NO | | caching_sha2_password | |
| authentication_string | text | YES | | NULL | |
| password_expired | enum('N','Y') | NO | | N | |
| password_last_changed | timestamp | YES | | NULL | |
| password_lifetime | smallint unsigned | YES | | NULL | |
| account_locked | enum('N','Y') | NO | | N | |
| Create_role_priv | enum('N','Y') | NO | | N | |
| Drop_role_priv | enum('N','Y') | NO | | N | |
| Password_reuse_history | smallint unsigned | YES | | NULL | |
| Password_reuse_time | smallint unsigned | YES | | NULL | |
| Password_require_current | enum('N','Y') | YES | | NULL | |
| User_attributes | json | YES | | NULL | |
+--------------------------+-----------------------------------+------+-----+-----------------------+-------+
51 rows in set (0.00 sec)字段解释：
- host：表示这个用户可以从哪个主机登陆，如果是localhost，表示只能从本机登陆
- user：用户名
- authentication_string：用户密码通过password函数加密后的
- *_priv：用户拥有的权限。
1.2 创建用户
create user '用户名'@'登陆主机/ip' identified by '密码';
例子：
sql
mysql> create user wsj@localhost identified by '123456';
Query OK, 0 rows affected (0.01 sec)
mysql> select user,host from user;
+------------------+-----------+
| user | host |
+------------------+-----------+
| debian-sys-maint | localhost |
| mysql.infoschema | localhost |
| mysql.session | localhost |
| mysql.sys | localhost |
| root | localhost |
| wsj | localhost | <--新创建的用户
+------------------+-----------+
6 rows in set (0.00 sec)登录试试：
sql
wsj@iZuf6dza8bf7vp0zjipnhmZ:~$ mysql -uwsj -hlocalhost -p
Enter password:
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 186
Server version: 8.0.46-0ubuntu0.22.04.3 (Ubuntu)
Copyright (c) 2000, 2026, Oracle and/or its affiliates.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql> 备注：可能实际在设置密码的时候，因为mysql本身的认证等级比较高，一些简单的密码无法设置，会爆出如下报错：
-- ERROR 1819 (HY000): Your password does not satisfy the current policy requirements
-- 解决方案：https://blog.csdn.net/zhanaolu4821/article/details/93622812
--查看密码设置相关要求：SHOW VARIABLES LIKE 'validate_password%';
不要轻易添加一个可以从任意地方登陆的 user：
sqlcreate user '用户名'@'%' identified by '密码';
1.3 删除用户
drop user '用户名'@'主机名';
例子：
sql
mysql> select user,host from user;
+------------------+-----------+
| user | host |
+------------------+-----------+
| debian-sys-maint | localhost |
| mysql.infoschema | localhost |
| mysql.session | localhost |
| mysql.sys | localhost |
| root | localhost |
| wsj | localhost |
+------------------+-----------+
6 rows in set (0.00 sec)
# 直接给个用户名，不能删除，它默认是%，表示所有地方可以登陆的用户。
mysql> drop user wsj;
ERROR 1396 (HY000): Operation DROP USER failed for 'wsj'@'%'
mysql> drop user wsj@localhost;
Query OK, 0 rows affected (0.01 sec)
mysql> select user,host from user;
+------------------+-----------+
| user | host |
+------------------+-----------+
| debian-sys-maint | localhost |
| mysql.infoschema | localhost |
| mysql.session | localhost |
| mysql.sys | localhost |
| root | localhost |
+------------------+-----------+
5 rows in set (0.00 sec)1.4 修改用户密码
自己改自己的密码
set password=password('新密码');
root 用户修改指定用户的密码
set password for '用户名'@'主机名'=password('新密码');
MySQL 8.0 以后移除了 password() 函数，可以使用下面的方法：-- 修改当前登录用户的密码
alter user current_user() identified by '密码';
-- 指定用户名修改
alter user '用户名'@'登录主机' identified by '密码';
sql
mysql> alter user current_user() identified by '111';
Query OK, 0 rows affected (0.01 sec)执行后通常会自动生效，也可以手动刷新以下权限(root)：
flush privileges;
2. 数据库的权限
MySQL 数据库提供的权限列表：
2.1 给用户授权
刚创建的用户没有任何权限，需要给用户授权
grant 权限列表 on 库.对项名(表名) to '用户名'@'登陆位置' identified by '密码'（用户还没创建的时候带）;
权限列表，多个权限用逗号分开
sql
grant select on ...
grant select, delete, create on ....
grant all [privileges] on ... -- 表示赋予该用户在该对象上的所有权限- *.*：代表本系统中的所有数据库的所有对象（表，视图，存储过程等）
- 库.*：表示某个数据库中的所有数据对象（表，视图，存储过程等）
- identified by 可选。如果用户存在，赋予权限的同时修改密码，如果该用户不存在，就是创建用户（MySQL 8.0 以后不再支持 GRANT 时自动创建用户，必须先用 CREATE USER 创建用户，再用 GRANT 授权）
如果发现赋权限后，没有生效，可以刷新一下（root）：
flush privileges;
2.2 回收权限
revoke 权限列表 on 库.对项名 from '用户名'@'登陆位置';
例子：
sql
-- 回收 wsj 对 test 数据库的所有权限
-- root 身份，终端A
mysql> revoke all on test.* from 'wsj'@'localhost';
Query OK, 0 rows affected (0.00 sec)
--whb身份，终端B
mysql> show databases;
+--------------------+
| Database |
+--------------------+
| information_schema |
| test |
+--------------------+
2 rows in set (0.00 sec)
mysql> show databases;
+--------------------+
| Database |
+--------------------+
| information_schema |
+--------------------+
1 row in set (0.00 sec)