MySQL users have a username and a
Host associated with them, so usually you'd identify the user by
'user'@'host'. The host part is there to assure only clients which connect from that specific host are allowed, even if they happen to have the correct username and password. It also allows two users with the same username, but from different hosts, to exist on the same MySQL server.
But wouldn't it be possible to spoof the host name of the client, so that I claim to be coming from the host of my victim? Do the
'host' part of a user really provide any extra security?