Let the following 2 lines fail if user exists and blahblah
doesnt matter for now:
create user 'root'@'localhost' identified by 'blahblah';
create user 'root'@'127.0.0.1' identified by 'blahblah';
Do your grants:
grant all on *.* to 'root'@'localhost';
grant all on *.* to 'root'@'127.0.0.1';
Change the password to something you will remember:
set password for 'root'@'localhost' = password('NewPassword');
set password for 'root'@'127.0.0.1' = password('NewPassword');
See how many root users you have. A real user is a user/host combo. The password will show up hashed:
select user,host,password from mysql.user where user='root';
or
select user,host,authentication_string from mysql.user where user='root';
The 2nd one above is for MySQL 5.7
If you get more than the two users above, drop the others such as:
drop user 'root'@'%'; -- this is the wildcard hostname, can be a security risk
drop user 'root'@'::1';
Still have only 2? I hope so. Use the select stmts above to check.
Don't connect a user app using root. root is for maintenance only. It doesn't matter if it is server-side code, or if an admin is running it. Code that is not secured and/or injected with harmful statements gets to run as root. So there, that is why.