Using Encrypted Connections to avoid accounts that contain wildcards in the  User  or  Host  column. Specifically, do not permit  User  to be empty (which creates an anonymous-user account), and do not permit pattern characters or netmask notation in  Host  values. All accounts must have a nonempty  User  value and literal  Host  value. With respect to the previous examples, the  ’’@’localhost’  and  ’user2’@’%.example.com’ accounts should be changed not to use wildcards: RENAME USER ’’@’localhost’ TO ’user1’@’localhost’; RENAME USER ’user2’@’%.example.com’ TO ’user2’@’remote.example.com’; If  user2  must be able to connect from several hosts in the  example.com  domain, there should be a separate account for each host. To extract the user name or host name part from a  CURRENT_USER()  or  USER()  value, use the SUBSTRING_INDEX()  function: With an unencrypted connection between the MySQL client and the server, someone with access to the network could watch all your traffic and inspect the data being sent or received between client and server. When you must move information over a network in a secure fashion, an unencrypted connection is unacceptable. To make any kind of data unreadable, use encryption. Encryption algorithms must include security elements to resist many kinds of known attacks such as changing the order of encrypted messages or replaying data twice. MySQL supports encrypted connections between clients and the server using the TLS (Transport Layer Security) protocol. TLS is sometimes referred to as SSL (Secure Sockets Layer) but MySQL does not actually use the SSL protocol for encrypted connections because its encryption is weak (see Section 6.3.2, “Encrypted Connection TLS Protocols and Ciphers” ). TLS uses encryption algorithms to ensure that data received over a public network can be trusted. It has mechanisms to detect data change, loss, or replay. TLS also incorporates algorithms that provide identity verification using the X.509 standard. X.509 makes it possible to identify someone on the Internet. In basic terms, there should be some entity called a “Certificate Authority”  (or CA) that assigns electronic certificates to anyone who needs them. Certificates rely on asymmetric encryption algorithms that have two encryption keys (a public key and a secret key). A certificate owner can present the certificate to another party as proof of identity. A certificate consists of its owner’s public key. Any data encrypted using this public key can be decrypted only using the corresponding secret key, which is held by the owner of the certificate. Support for encrypted connections in MySQL is provided using OpenSSL. For information about the encryption protocols and ciphers that OpenSSL supports, see Section 6.3.2, “Encrypted Connection TLS Protocols and Ciphers” . 1280 6.3 Using Encrypted Connections mysql>  SELECT SUBSTRING_INDEX(CURRENT_USER(),’@’,1); +---------------------------------------+ | SUBSTRING_INDEX(CURRENT_USER(),’@’,1) | +---------------------------------------+ | user1 | +---------------------------------------+ mysql>  SELECT SUBSTRING_INDEX(CURRENT_USER(),’@’,-1); +----------------------------------------+ | SUBSTRING_INDEX(CURRENT_USER(),’@’,-1) | +----------------------------------------+ | localhost | +----------------------------------------+