Use ` instead of ' in the database name, and escape the _
GRANT ALL PRIVILEGES ON xian\_%.* TO xian@'192.168.1.%';
xian\_%