In my PHP script, I\'m accessing two databases db1
and db2
. I have a user myuser@localhost
that can access db1
but can\'
This very likely has nothing to do with GRANTs.
A very common reason for having incorrect access rights is because of default users that exist in MySQL. Specially ones with ''
for User
(anonymous users) and/or Host
in mysql.user
table. Because of the way MySQL handles authentication and proxy users, and the sorting rules used on mysql.user
table entries, one could end up using an unexpected user than the one they used for authentication.
Use SELECT USER();
to find out the connecting user that was used during authentication and SELECT CURRENT_USER();
to find out the effective user whose privileges apply during the current session.
And from http://dev.mysql.com/doc/refman/5.6/en/connection-access.html
It is a common misconception to think that, for a given user name, all rows that explicitly name that user are used first when the server attempts to find a match for the connection. This is not true. If you are able to connect to the server, but your privileges are not what you expect, you probably are being authenticated as some other account.
A mysql.user
table similar to following
+-----------+----------+-
| Host | User | ...
+-----------+----------+-
| % | root | ... (root from any host)
| % | jeffrey | ... (jeffrey from any host)
| localhost | root | ... (root from localhost)
| localhost | | ... (any user from localhost)
+-----------+----------+-
becomes,
+-----------+----------+-
| Host | User | ...
+-----------+----------+-
| localhost | root | ...
| localhost | | ...
| % | jeffrey | ...
| % | root | ...
+-----------+----------+-
whenever the server reads the user table into memory, in order to handle multiple matches.
When a client attempts to connect, the server looks through the rows in sorted order and uses the first row that matches the client host name and user name.
Precedence is given as: values (IP address, host name, user name, etc.) > '%'
> ''
Most of the time application server/client is running in the same host as the database, causing the host name to be picked up as localhost
during authentication.
mysql -u jeffrey
uses jeffrey@localhost
which gets matched against ''@localhost
instead of jeffrey@%
.
Executing $MYSQL_HOME/bin/mysql_secure_installation
will remove anonymous users, while securing the installation, alleviating this unexpected behaviour.
Also check:
[1] http://bugs.mysql.com/bug.php?id=36576 (check comment before last)
[2] http://bugs.mysql.com/bug.php?id=69570