Access Control, Stage 2: Request Verification •A  ’%’  or blank  Host  value means “any host.” •A  ’%’  or blank  Db  value means “any database.” •The wildcard characters  %  and  _  can be used in the  Host  column. These have the same meaning as for pattern-matching operations performed with the  LIKE  operator. •A  ’%’  or blank  Host  value means “any host.” •The  Db ,  Table_name ,  Column_name , and  Routine_name  columns cannot contain wildcards or be blank. •The server looks in the  db  table for a match on the  Host ,  Db , and  User  columns. •The  Host  and  User  columns are matched to the connecting user’s host name and MySQL user name. •The  Db  column is matched to the database that the user wants to access. •If there is no row for the  Host  and  User , access is denied. 1221 global privileges OR database privileges OR table privileges OR column privileges Expressed in boolean terms, the preceding description of how a user’s privileges are calculated may be summarized like this: After determining the database-specific privileges granted by the  db  table rows, the server adds them to the global privileges granted by the  user  table. If the result permits the requested operation, access is granted. Otherwise, the server successively checks the user’s table and column privileges in the tables_priv  and  columns_priv  tables, adds those to the user’s privileges, and permits or denies access based on the result. For stored-routine operations, the server uses the  procs_priv  table rather than  tables_priv  and  columns_priv . For database-related requests ( INSERT ,  UPDATE , and so on), the server first checks the user’s global privileges in the  user  table row (less any privilege restrictions imposed by partial revokes). If the row permits the requested operation, access is granted. If the global privileges in the  user  table are insufficient, the server determines the user’s database-specific privileges from the  db  table: The server uses the sorted tables to verify each request that it receives. For requests that require administrative privileges such as  SHUTDOWN  or  RELOAD , the server checks only the  user  and global_privilege  tables because those are the only tables that specify administrative privileges. The server grants access if a row for the account in those tables permits the requested operation and denies access otherwise. For example, if you want to execute  mysqladmin shutdown  but your  user  table row does not grant the  SHUTDOWN  privilege to you, the server denies access without even checking the  db table. (The latter table contains no  Shutdown_priv  column, so there is no need to check it.) The server sorts the  tables_priv ,  columns_priv , and  procs_priv  tables based on the  Host ,  Db , and  User  columns. This is similar to  db  table sorting, but simpler because only the  Host  column can contain wildcards. The  tables_priv ,  columns_priv , and  procs_priv  tables grant table-specific, column-specific, and routine-specific privileges. Values in the scope columns of these tables can take the following forms: The server reads the  db  table into memory and sorts it at the same time that it reads the  user  table. The server sorts the  db  table based on the  Host ,  Db , and  User  scope columns. As with the  user  table, sorting puts the most-specific values first and least-specific values last, and when the server looks for matching rows, it uses the first match that it finds.