The default install of MySQL on Windows allows users to:
- Connect as root (with no password) from the localhost or any remote host. A root user can perform any operation to any database, even delete them.
- Connect as an anonymous user (with no username or password). If you are connecting from localhost, you are allowed root privileges. Otherwise you are allowed to connect to any database whose name begins with "test"
This leaves your machine in a quite vulnerable state. At the least, you'll want to assign a password for the root user and delete the anonymous user privileges if they aren't necessary for your setup.
First, make sure mysql is running. Navigate to your mysql/bin directory (default is C:\mysql\bin) and click on winmysqladmin.exe. If it prompts you for a username and password, hit cancel.
Open up a command prompt and type in the following:
C:\mysql\bin>mysql -u root
mysql> USE mysql;
mysql> UPDATE user SET Password=PASSWORD('your_password') WHERE User='root';
mysql> FLUSH PRIVILEGES;
And to remove those anonymous user entries in the user table, connect to the server as root using your new password and delete the rows.
C:\mysql\bin>mysql -p -u root mysql> USE mysql; mysql> DELETE FROM user WHERE User=''; mysql> DELETE FROM db WHERE User=''; mysql> FLUSH PRIVILEGES;

