up vote 0 down vote favorite
share [g+] share [fb]

It seems the new hacker tool refref has been launched, and apparently it abuses a bug in the mysqli extension. Now I do not use mysqli at all for my websites, so i thought the best way to fight off this refref tool was to completely disable mysqli.

enter image description here

These are the settings i have set in my php.ini. Is there a way I can disable mysqli completely with having to recompile PHP?

;extension=php_mysqli.dll

[MySQLi]
mysqli.max_persistent = -1
;mysqli.allow_local_infile = On
mysqli.allow_persistent = On
mysqli.max_links = -1
mysqli.cache_size = 2000
mysqli.default_port = 3306
mysqli.default_socket =
mysqli.default_host =
mysqli.default_user =
mysqli.default_pw =
mysqli.reconnect = Off
link|improve this question
73% accept rate
check "Configuration File (php.ini) Path" on phpinfo, edit php.ini that you get from php.info, make sure commented ";extension=php_mysqli.dll". restart apache/iis – Rikih Aug 15 '11 at 9:28
the path shows, /etc/php.ini, which is the file i used to get the values displayed above from. – FunkyChicken Aug 15 '11 at 9:39
may be there is separate configuration that load extension=mysqli.so. just try grep -R mysqli.so /etc/. usually the extension on /usr/lib/php/modules/mysqli.so or /usr/lib64/php/modules/mysqli.so. – Rikih Aug 15 '11 at 10:17
The folder /usr/lib64/php/modules is there, but only contains phpcups.so, no other .so files. – FunkyChicken Aug 15 '11 at 10:29
weird. how about updatedb && locate mysqli.so ?. – Rikih Aug 15 '11 at 10:34
show 3 more comments
feedback

2 Answers

up vote 1 down vote

It is already deactivated. This is what the semicolon in front of the line

;extension=php_mysqli.dll

is for: It comments out the command to load this library.

link|improve this answer
Yeah i noticed in /etc/php.ini that its disabled already, but when I run <?php phpinfo(); ?> it is clearly enabled, as you can see from the screenshot. Also, var_dump(function_exists('mysqli_connect')); returns TRUE. – FunkyChicken Aug 15 '11 at 9:33
Is there any other ini file where this could be loaded? Also, is /etc the correct location for php.ini on Windows? – SvenW Aug 15 '11 at 9:39
I am running CentOS 5.6, with php-fpm & nginx. Not Windows. /etc/php.ini is the correct php.ini file. I have editted it in the past, and changes always worked. – FunkyChicken Aug 15 '11 at 9:52
Is there some subdirectory for PHP configurations in /etc or elsewhere that might get referenced in /etc/php.ini? On Linux, the extension for the library should be so, not dll. Maybe try grep -R mysqli.so /etc/* to find any line referencing this library. – SvenW Aug 15 '11 at 10:08
nothing found. mysqli.so cant be found on the entire system. I did: whereis mysqli.so. Also, i found my php extension dir: /opt/php/lib/php/extensions/no-debug-non-zts-20090626, and it only has memcache.so in it. No other files. – FunkyChicken Aug 15 '11 at 10:19
feedback
up vote 1 down vote

You probably have a pre-compiled mysqli extension

you can still disable functions by adding this to your php.ini:

disable_functions = mysqli_affected_rows,mysqli_autocommit,mysqli_change_user,mysqli_character_set_name,mysqli_close,mysqli_commit,mysqli_connect,mysqli_connect_errno,mysqli_connect_error,mysqli_data_seek,mysqli_dump_debug_info,mysqli_debug,mysqli_errno,mysqli_error,mysqli_stmt_execute,mysqli_execute,mysqli_fetch_field,mysqli_fetch_fields,mysqli_fetch_field_direct,mysqli_fetch_lengths,mysqli_fetch_all,mysqli_fetch_array,mysqli_fetch_assoc,mysqli_fetch_object,mysqli_fetch_row,mysqli_field_count,mysqli_field_seek,mysqli_field_tell,mysqli_free_result,mysqli_get_cache_stats,mysqli_get_connection_stats,mysqli_get_client_stats,mysqli_get_charset,mysqli_get_client_info,mysqli_get_client_version,mysqli_get_host_info,mysqli_get_proto_info,mysqli_get_server_info,mysqli_get_server_version,mysqli_get_warnings,mysqli_init,mysqli_info,mysqli_insert_id,mysqli_kill,mysqli_more_results,mysqli_multi_query,mysqli_next_result,mysqli_num_fields,mysqli_num_rows,mysqli_options,mysqli_ping,mysqli_poll,mysqli_prepare,mysqli_report,mysqli_query,mysqli_real_connect,mysqli_real_escape_string,mysqli_real_query,mysqli_reap_async_query,mysqli_rollback,mysqli_select_db,mysqli_set_charset,mysqli_stmt_affected_rows,mysqli_stmt_attr_get,mysqli_stmt_attr_set,mysqli_stmt_bind_param,mysqli_stmt_bind_result,mysqli_stmt_close,mysqli_stmt_data_seek,mysqli_stmt_errno,mysqli_stmt_error,mysqli_stmt_fetch,mysqli_stmt_field_count,mysqli_stmt_free_result,mysqli_stmt_get_result,mysqli_stmt_get_warnings,mysqli_stmt_init,mysqli_stmt_insert_id,mysqli_stmt_more_results,mysqli_stmt_next_result,mysqli_stmt_num_rows,mysqli_stmt_param_count,mysqli_stmt_prepare,mysqli_stmt_reset,mysqli_stmt_result_metadata,mysqli_stmt_send_long_data,mysqli_stmt_store_result,mysqli_stmt_sqlstate,mysqli_sqlstate,mysqli_ssl_set,mysqli_stat,mysqli_store_result,mysqli_thread_id,mysqli_thread_safe,mysqli_use_result,mysqli_warning_count,mysqli_refresh,mysqli_bind_param,mysqli_bind_result,mysqli_client_encoding,mysqli_escape_string,mysqli_fetch,mysqli_param_count,mysqli_get_metadata,mysqli_send_long_data,mysqli_set_opt
link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.