Account Management Statements In  GRANT  statements, the  ALL [PRIVILEGES]  or  PROXY  privilege must be named by itself and cannot be specified along with other privileges.  ALL [PRIVILEGES]  stands for all privileges available for the level at which privileges are to be granted except for the  GRANT OPTION  and  PROXY  privileges. MySQL account information is stored in the tables of the  mysql  system schema. For additional details, consult Section 6.2, “Access Control and Account Management” , which discusses the  mysql  system schema and the access control system extensively. If the grant tables hold privilege rows that contain mixed-case database or table names and the lower_case_table_names  system variable is set to a nonzero value,  REVOKE  cannot be used to revoke these privileges. It is necessary in such cases to manipulate the grant tables directly. ( GRANT  does not create such rows when  lower_case_table_names  is set, but such rows might have been created prior to setting that variable. The  lower_case_table_names  setting can only be configured at server startup.) Privileges can be granted at several levels, depending on the syntax used for the  ON  clause. For  REVOKE , the same  ON  syntax specifies which privileges to remove. For the global, database, table, and routine levels,  GRANT ALL  assigns only the privileges that exist at the level you are granting. For example,  GRANT ALL ON  db_name .*  is a database-level statement, so it does not grant any global-only privileges such as  FILE . Granting  ALL  does not assign the  GRANT OPTION or  PROXY  privilege. The  object_type  clause, if present, should be specified as  TABLE ,  FUNCTION , or  PROCEDURE  when the following object is a table, a stored function, or a stored procedure. The privileges that a user holds for a database, table, column, or routine are formed additively as the logical  OR  of the account privileges at each of the privilege levels, including the global level. It is not possible to deny a privilege granted at a higher level by absence of that privilege at a lower level. For example, this statement grants the  SELECT  and  INSERT  privileges globally: GRANT SELECT, INSERT ON *.* TO u1; The globally granted privileges apply to all databases, tables, and columns, even though not granted at any of those lower levels. As of MySQL 8.0.16, it is possible to explicitly deny a privilege granted at the global level by revoking it for particular databases, if the  partial_revokes  system variable is enabled: GRANT SELECT, INSERT, UPDATE ON *.* TO u1; REVOKE INSERT, UPDATE ON db1.* FROM u1; The result of the preceding statements is that  SELECT  applies globally to all tables, whereas  INSERT  and UPDATE  apply globally except to tables in  db1 . Account access to  db1  is read only. Details of the privilege-checking procedure are presented in Section 6.2.7, “Access Control, Stage 2: Request Verification” . If you are using table, column, or routine privileges for even one user, the server examines table, column, and routine privileges for all users and this slows down MySQL a bit. Similarly, if you limit the number of queries, updates, or connections for any users, the server must monitor these values. MySQL enables you to grant privileges on databases or tables that do not exist. For tables, the privileges to be granted must include the  CREATE  privilege.  This behavior is by design , and is intended to enable the database administrator to prepare user accounts and privileges for databases or tables that are to be created at a later time. 2870