•A ’%’  or blank Host  value means “any host.” 

•A ’%’  or blank Db  value means “any database.” 

The server reads the db  table into memory and sorts it at the same time that it reads the user  table. The server sorts the db  table based on the Host , Db , and User  scope columns. As with the user  table, sorting puts the most-specific values first and least-specific values last, and when the server looks for matching rows, it uses the first match that it finds. 

The tables_priv , columns_priv , and procs_priv  tables grant table-specific, column-specific, and routine-specific privileges. Values in the scope columns of these tables can take the following forms: 

•The wildcard characters %  and _  can be used in the Host  column. These have the same meaning as for pattern-matching operations performed with the LIKE  operator. 

•A ’%’  or blank Host  value means “any host.” 

•The Db , Table_name , Column_name , and Routine_name  columns cannot contain wildcards or be blank. 

The server sorts the tables_priv , columns_priv , and procs_priv  tables based on the Host , Db , and User  columns. This is similar to db  table sorting, but simpler because only the Host  column can contain wildcards. 

The server uses the sorted tables to verify each request that it receives. For requests that require administrative privileges such as SHUTDOWN  or RELOAD , the server checks only the user  and global_privilege  tables because those are the only tables that specify administrative privileges. The server grants access if a row for the account in those tables permits the requested operation and denies access otherwise. For example, if you want to execute mysqladmin shutdown  but your user  table row does not grant the SHUTDOWN  privilege to you, the server denies access without even checking the db table. (The latter table contains no Shutdown_priv  column, so there is no need to check it.) 

For database-related requests ( INSERT , UPDATE , and so on), the server first checks the user’s global privileges in the user  table row (less any privilege restrictions imposed by partial revokes). If the row permits the requested operation, access is granted. If the global privileges in the user  table are insufficient, the server determines the user’s database-specific privileges from the db  table: 

•The server looks in the db  table for a match on the Host , Db , and User  columns. 

•The Host  and User  columns are matched to the connecting user’s host name and MySQL user name. 

•The Db  column is matched to the database that the user wants to access. 

•If there is no row for the Host  and User , access is denied. 

After determining the database-specific privileges granted by the db  table rows, the server adds them to the global privileges granted by the user  table. If the result permits the requested operation, access is granted. Otherwise, the server successively checks the user’s table and column privileges in the tables_priv  and columns_priv  tables, adds those to the user’s privileges, and permits or denies access based on the result. For stored-routine operations, the server uses the procs_priv  table rather than tables_priv  and columns_priv . 

Expressed in boolean terms, the preceding description of how a user’s privileges are calculated may be summarized like this: 

global privileges OR database privileges OR table privileges OR column privileges 

