If you know that you will be accessing the database from a
specific host (
www.aaa.com in your example) then this is
what you should specify in the permissions on the database.
The % is a wildcard that will give access to the database to
any host that authenticates with the username and password
you set up and this is a security hole. That means if I can
manage to read your config file I will be able to access your
database from my laptop unless there's a firewall protecting it.