In MySql, the concept of "account" is tied to two things:a username and a hostname.That is,when you connect to the server,it checks not only the username that you specify,but also what host you're connecting from.One implication of thie concept of an concept of an account is that it is possible to set up separate accounts for different users who have the same username but connect from different hosts.       

1  Permissible Privileges for GRANT and REVOKE

Privilege	Meaning and Grantable Levels
ALL [PRIVILEGES]	Grant all privileges at specified access level except GRANT OPTION andPROXY.
ALTER	Enable use of ALTER TABLE. Levels: Global, database, table.
ALTER ROUTINE	Enable stored routines to be altered or dropped. Levels: Global, database, routine.
CREATE	Enable database and table creation. Levels: Global, database, table.
CREATE ROUTINE	Enable stored routine creation. Levels: Global, database.
CREATE TABLESPACE	Enable tablespaces and log file groups to be created, altered, or dropped. Level: Global.
CREATE TEMPORARY TABLES	Enable use of CREATE TEMPORARY TABLE. Levels: Global, database.
CREATE USER	Enable use of CREATE USER, DROP USER, RENAME USER, and REVOKE ALL PRIVILEGES. Level: Global.
CREATE VIEW	Enable views to be created or altered. Levels: Global, database, table.
DELETE	Enable use of DELETE. Level: Global, database, table.
DROP	Enable databases, tables, and views to be dropped. Levels: Global, database, table.
EVENT	Enable use of events for the Event Scheduler. Levels: Global, database.
EXECUTE	Enable the user to execute stored routines. Levels: Global, database, routine.
FILE	Enable the user to cause the server to read or write files. Level: Global.
GRANT OPTION	Enable privileges to be granted to or removed from other accounts. Levels: Global, database, table, routine, proxy.
INDEX	Enable indexes to be created or dropped. Levels: Global, database, table.
INSERT	Enable use of INSERT. Levels: Global, database, table, column.
LOCK TABLES	Enable use of LOCK TABLES on tables for which you have the SELECTprivilege. Levels: Global, database.
PROCESS	Enable the user to see all processes with SHOW PROCESSLIST. Level: Global.
PROXY	Enable user proxying. Level: From user to user.
REFERENCES	Enable foreign key creation. Levels: Global, database, table, column.
RELOAD	Enable use of FLUSH operations. Level: Global.
REPLICATION CLIENT	Enable the user to ask where master or slave servers are. Level: Global.
REPLICATION SLAVE	Enable replication slaves to read binary log events from the master. Level: Global.
SELECT	Enable use of SELECT. Levels: Global, database, table, column.
SHOW DATABASES	Enable SHOW DATABASES to show all databases. Level: Global.
SHOW VIEW	Enable use of SHOW CREATE VIEW. Levels: Global, database, table.
SHUTDOWN	Enable use of mysqladmin shutdown. Level: Global.
SUPER	Enable use of other administrative operations such as CHANGE MASTER TO, KILL, PURGE BINARY LOGS, SET GLOBAL, and mysqladmin debugcommand. Level: Global.
TRIGGER	Enable trigger operations. Levels: Global, database, table.
UPDATE	Enable use of UPDATE. Levels: Global, database, table, column.
USAGE	Synonym for “no privileges”

2 The Grant Tables

These mysql database tables contain grant information:

• user: User accounts, global privileges, and other non-privilege columns
• db: Database-level privileges
• tables_priv: Table-level privileges
• columns_priv: Column-level privileges
• procs_priv: Stored procedure and function privileges
• proxies_priv: Proxy-user privileges

3  Creating and Droping User Accounts

%:指任何主机，但不包括localhost

• 创建一个不分配任何权限的用户 ，此账户只在server（localhost）服务器登录 
   create user 'jim'@'localhost'  identified by 'Abcd@123';
   
• 创建一个不分配任何权限的用户 ，此账户只在任何一台机器（% 但不包含服务器自己 ）上登录 
   create user 'jim'@'%'  identified by 'Abcd@123';
• 删除用户
  drop user 'jim'@'localhost';
• 重命名用户
  rename user 'jim'@'localhost' to 'jack'@'localhsot';
   

4 Grantint Privileges

• 授予权限

     语法：权限 对象 账户 密码

     创建jim 账户，允许其查询 数据库tb1下的所有对象。     

      grant select on tb1.* to 'jim'@'localhost' identified by 'Abcd@123';    

     all  表示所有权限

    *.* 表示 所有数据库 的 所有对象

   一般不允许 创建 grant all on  *.*  to  ‘username’@'%' identified by 'Abcd@123';  权限太大

•  查询权限

      show grants; show grants for current_user; 列出当前用户权限

     show grants for 'root'@'localhost'; 列出指定用户权限
 

4 Revoking Privileges

 语法 revoke 权限 on 对象 from '用户'@主机

revoke select  on tb1 .* from 'jim'@'localhost';

回收的权限和对象 必须完全与grans 一致