As mentioned previously, the AS  clause can only add privilege restrictions; it cannot escalate privileges. Thus, although u1  has the DELETE  privilege, that is not included in the privileges granted because the statement does not specify granting DELETE . 

•The AS  clause for the GRANT  statement here makes the role r1  active for u1 . That role lifts some of the restrictions on u1 . Consequently, the privileges granted have some restrictions, but not so many as for the previous GRANT  statement: 

mysql> CREATE USER u4; mysql> GRANT SELECT, INSERT, UPDATE ON *.* TO u4 AS u1 WITH ROLE r1; mysql> SHOW GRANTS FOR u4; +-------------------------------------------------+ | Grants for u4@% | +-------------------------------------------------+ | GRANT SELECT, INSERT, UPDATE ON *.* TO ‘u4‘@‘%‘ | | REVOKE UPDATE ON ‘schema1‘.* FROM ‘u4‘@‘%‘ | +-------------------------------------------------+ 

If a GRANT  statement includes an AS user  clause, privilege restrictions on the user who executes the statement are ignored (rather than applied as they would be in the absence of an AS  clause). 

## Other Account Characteristics 

The optional WITH  clause is used to enable a user to grant privileges to other users. The WITH GRANT OPTION  clause gives the user the ability to give to other users any privileges the user has at the specified privilege level. 

To grant the GRANT OPTION  privilege to an account without otherwise changing its privileges, do this: 

GRANT USAGE ON *.* TO ’someuser’@’somehost’ WITH GRANT OPTION; 

Be careful to whom you give the GRANT OPTION  privilege because two users with different privileges may be able to combine privileges! 

You cannot grant another user a privilege which you yourself do not have; the GRANT OPTION  privilege enables you to assign only those privileges which you yourself possess. 

Be aware that when you grant a user the GRANT OPTION  privilege at a particular privilege level, any privileges the user possesses (or may be given in the future) at that level can also be granted by that user to other users. Suppose that you grant a user the INSERT  privilege on a database. If you then grant the SELECT  privilege on the database and specify WITH GRANT OPTION , that user can give to other users not only the SELECT  privilege, but also INSERT . If you then grant the UPDATE  privilege to the user on the database, the user can grant INSERT , SELECT , and UPDATE . 

For a nonadministrative user, you should not grant the ALTER  privilege globally or for the mysql  system schema. If you do that, the user can try to subvert the privilege system by renaming tables! 

For additional information about security risks associated with particular privileges, see Section 6.2.2, “Privileges Provided by MySQL” . 

## MySQL and Standard SQL Versions of GRANT 

The biggest differences between the MySQL and standard SQL versions of GRANT  are: 

•MySQL associates privileges with the combination of a host name and user name and not with only a user name. 

•Standard SQL does not have global or database-level privileges, nor does it support all the privilege types that MySQL supports. 

