Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

It seems the new hacker tool refref has been launched, and apparently it abuses a bug in the mysqli extension. Now I do not use mysqli at all for my websites, so i thought the best way to fight off this refref tool was to completely disable mysqli.

enter image description here

These are the settings i have set in my php.ini. Is there a way I can disable mysqli completely with having to recompile PHP?

;extension=php_mysqli.dll

[MySQLi]
mysqli.max_persistent = -1
;mysqli.allow_local_infile = On
mysqli.allow_persistent = On
mysqli.max_links = -1
mysqli.cache_size = 2000
mysqli.default_port = 3306
mysqli.default_socket =
mysqli.default_host =
mysqli.default_user =
mysqli.default_pw =
mysqli.reconnect = Off
share|improve this question
    
check "Configuration File (php.ini) Path" on phpinfo, edit php.ini that you get from php.info, make sure commented ";extension=php_mysqli.dll". restart apache/iis –  Rikih Aug 15 '11 at 9:28
    
the path shows, /etc/php.ini, which is the file i used to get the values displayed above from. –  Mr.Boon Aug 15 '11 at 9:39
    
may be there is separate configuration that load extension=mysqli.so. just try grep -R mysqli.so /etc/. usually the extension on /usr/lib/php/modules/mysqli.so or /usr/lib64/php/modules/mysqli.so. –  Rikih Aug 15 '11 at 10:17
    
The folder /usr/lib64/php/modules is there, but only contains phpcups.so, no other .so files. –  Mr.Boon Aug 15 '11 at 10:29
    
weird. how about updatedb && locate mysqli.so ?. –  Rikih Aug 15 '11 at 10:34
show 3 more comments

2 Answers

up vote 2 down vote accepted

You probably have a pre-compiled mysqli extension

you can still disable functions by adding this to your php.ini:

disable_functions = mysqli_affected_rows,mysqli_autocommit,mysqli_change_user,mysqli_character_set_name,mysqli_close,mysqli_commit,mysqli_connect,mysqli_connect_errno,mysqli_connect_error,mysqli_data_seek,mysqli_dump_debug_info,mysqli_debug,mysqli_errno,mysqli_error,mysqli_stmt_execute,mysqli_execute,mysqli_fetch_field,mysqli_fetch_fields,mysqli_fetch_field_direct,mysqli_fetch_lengths,mysqli_fetch_all,mysqli_fetch_array,mysqli_fetch_assoc,mysqli_fetch_object,mysqli_fetch_row,mysqli_field_count,mysqli_field_seek,mysqli_field_tell,mysqli_free_result,mysqli_get_cache_stats,mysqli_get_connection_stats,mysqli_get_client_stats,mysqli_get_charset,mysqli_get_client_info,mysqli_get_client_version,mysqli_get_host_info,mysqli_get_proto_info,mysqli_get_server_info,mysqli_get_server_version,mysqli_get_warnings,mysqli_init,mysqli_info,mysqli_insert_id,mysqli_kill,mysqli_more_results,mysqli_multi_query,mysqli_next_result,mysqli_num_fields,mysqli_num_rows,mysqli_options,mysqli_ping,mysqli_poll,mysqli_prepare,mysqli_report,mysqli_query,mysqli_real_connect,mysqli_real_escape_string,mysqli_real_query,mysqli_reap_async_query,mysqli_rollback,mysqli_select_db,mysqli_set_charset,mysqli_stmt_affected_rows,mysqli_stmt_attr_get,mysqli_stmt_attr_set,mysqli_stmt_bind_param,mysqli_stmt_bind_result,mysqli_stmt_close,mysqli_stmt_data_seek,mysqli_stmt_errno,mysqli_stmt_error,mysqli_stmt_fetch,mysqli_stmt_field_count,mysqli_stmt_free_result,mysqli_stmt_get_result,mysqli_stmt_get_warnings,mysqli_stmt_init,mysqli_stmt_insert_id,mysqli_stmt_more_results,mysqli_stmt_next_result,mysqli_stmt_num_rows,mysqli_stmt_param_count,mysqli_stmt_prepare,mysqli_stmt_reset,mysqli_stmt_result_metadata,mysqli_stmt_send_long_data,mysqli_stmt_store_result,mysqli_stmt_sqlstate,mysqli_sqlstate,mysqli_ssl_set,mysqli_stat,mysqli_store_result,mysqli_thread_id,mysqli_thread_safe,mysqli_use_result,mysqli_warning_count,mysqli_refresh,mysqli_bind_param,mysqli_bind_result,mysqli_client_encoding,mysqli_escape_string,mysqli_fetch,mysqli_param_count,mysqli_get_metadata,mysqli_send_long_data,mysqli_set_opt
share|improve this answer
add comment

It is already deactivated. This is what the semicolon in front of the line

;extension=php_mysqli.dll

is for: It comments out the command to load this library.

share|improve this answer
    
Yeah i noticed in /etc/php.ini that its disabled already, but when I run <?php phpinfo(); ?> it is clearly enabled, as you can see from the screenshot. Also, var_dump(function_exists('mysqli_connect')); returns TRUE. –  Mr.Boon Aug 15 '11 at 9:33
    
Is there any other ini file where this could be loaded? Also, is /etc the correct location for php.ini on Windows? –  SvW Aug 15 '11 at 9:39
    
I am running CentOS 5.6, with php-fpm & nginx. Not Windows. /etc/php.ini is the correct php.ini file. I have editted it in the past, and changes always worked. –  Mr.Boon Aug 15 '11 at 9:52
    
Is there some subdirectory for PHP configurations in /etc or elsewhere that might get referenced in /etc/php.ini? On Linux, the extension for the library should be so, not dll. Maybe try grep -R mysqli.so /etc/* to find any line referencing this library. –  SvW Aug 15 '11 at 10:08
    
nothing found. mysqli.so cant be found on the entire system. I did: whereis mysqli.so. Also, i found my php extension dir: /opt/php/lib/php/extensions/no-debug-non-zts-20090626, and it only has memcache.so in it. No other files. –  Mr.Boon Aug 15 '11 at 10:19
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.