mysql “grant all” vs “grant all privileges”

Question

what is the difference between these two commands?

GRANT ALL ON druid.* TO 'druid'@'localhost' IDENTIFIED BY 'diurd';
GRANT ALL PRIVILEGES ON *.* TO druid@'%' IDENTIFIED BY 'diurd';

Answer 1

They are equivalent with respect to the privileges syntax; PRIVILEGES is optional. Source

The scope of those permissions, however, is different. One command gives privileges on all databases ( *.* ) and the other gives them only on tables in database druid ( druid.* ).

In addition, one allows connections only from localhost , but the other allows them from anywhere ( % ).

Finally, druid@'%' will give a syntax error; you need quotes around druid .

As a best practice, make the permissions as limited as possible (local-only, with permissions to do as little as possible in as few places as possible).