Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

It seems the new hacker tool refref has been launched, and apparently it abuses a bug in the mysqli extension. Now I do not use mysqli at all for my websites, so i thought the best way to fight off this refref tool was to completely disable mysqli.

enter image description here

These are the settings i have set in my php.ini. Is there a way I can disable mysqli completely with having to recompile PHP?


mysqli.max_persistent = -1
;mysqli.allow_local_infile = On
mysqli.allow_persistent = On
mysqli.max_links = -1
mysqli.cache_size = 2000
mysqli.default_port = 3306
mysqli.default_socket =
mysqli.default_host =
mysqli.default_user =
mysqli.default_pw =
mysqli.reconnect = Off
share|improve this question
check "Configuration File (php.ini) Path" on phpinfo, edit php.ini that you get from, make sure commented ";extension=php_mysqli.dll". restart apache/iis – chocripple Aug 15 '11 at 9:28
the path shows, /etc/php.ini, which is the file i used to get the values displayed above from. – Mr.Boon Aug 15 '11 at 9:39
may be there is separate configuration that load just try grep -R /etc/. usually the extension on /usr/lib/php/modules/ or /usr/lib64/php/modules/ – chocripple Aug 15 '11 at 10:17
The folder /usr/lib64/php/modules is there, but only contains, no other .so files. – Mr.Boon Aug 15 '11 at 10:29
weird. how about updatedb && locate ?. – chocripple Aug 15 '11 at 10:34
up vote 2 down vote accepted

You probably have a pre-compiled mysqli extension

you can still disable functions by adding this to your php.ini:

disable_functions = mysqli_affected_rows,mysqli_autocommit,mysqli_change_user,mysqli_character_set_name,mysqli_close,mysqli_commit,mysqli_connect,mysqli_connect_errno,mysqli_connect_error,mysqli_data_seek,mysqli_dump_debug_info,mysqli_debug,mysqli_errno,mysqli_error,mysqli_stmt_execute,mysqli_execute,mysqli_fetch_field,mysqli_fetch_fields,mysqli_fetch_field_direct,mysqli_fetch_lengths,mysqli_fetch_all,mysqli_fetch_array,mysqli_fetch_assoc,mysqli_fetch_object,mysqli_fetch_row,mysqli_field_count,mysqli_field_seek,mysqli_field_tell,mysqli_free_result,mysqli_get_cache_stats,mysqli_get_connection_stats,mysqli_get_client_stats,mysqli_get_charset,mysqli_get_client_info,mysqli_get_client_version,mysqli_get_host_info,mysqli_get_proto_info,mysqli_get_server_info,mysqli_get_server_version,mysqli_get_warnings,mysqli_init,mysqli_info,mysqli_insert_id,mysqli_kill,mysqli_more_results,mysqli_multi_query,mysqli_next_result,mysqli_num_fields,mysqli_num_rows,mysqli_options,mysqli_ping,mysqli_poll,mysqli_prepare,mysqli_report,mysqli_query,mysqli_real_connect,mysqli_real_escape_string,mysqli_real_query,mysqli_reap_async_query,mysqli_rollback,mysqli_select_db,mysqli_set_charset,mysqli_stmt_affected_rows,mysqli_stmt_attr_get,mysqli_stmt_attr_set,mysqli_stmt_bind_param,mysqli_stmt_bind_result,mysqli_stmt_close,mysqli_stmt_data_seek,mysqli_stmt_errno,mysqli_stmt_error,mysqli_stmt_fetch,mysqli_stmt_field_count,mysqli_stmt_free_result,mysqli_stmt_get_result,mysqli_stmt_get_warnings,mysqli_stmt_init,mysqli_stmt_insert_id,mysqli_stmt_more_results,mysqli_stmt_next_result,mysqli_stmt_num_rows,mysqli_stmt_param_count,mysqli_stmt_prepare,mysqli_stmt_reset,mysqli_stmt_result_metadata,mysqli_stmt_send_long_data,mysqli_stmt_store_result,mysqli_stmt_sqlstate,mysqli_sqlstate,mysqli_ssl_set,mysqli_stat,mysqli_store_result,mysqli_thread_id,mysqli_thread_safe,mysqli_use_result,mysqli_warning_count,mysqli_refresh,mysqli_bind_param,mysqli_bind_result,mysqli_client_encoding,mysqli_escape_string,mysqli_fetch,mysqli_param_count,mysqli_get_metadata,mysqli_send_long_data,mysqli_set_opt
share|improve this answer

It is already deactivated. This is what the semicolon in front of the line


is for: It comments out the command to load this library.

share|improve this answer
Yeah i noticed in /etc/php.ini that its disabled already, but when I run <?php phpinfo(); ?> it is clearly enabled, as you can see from the screenshot. Also, var_dump(function_exists('mysqli_connect')); returns TRUE. – Mr.Boon Aug 15 '11 at 9:33
Is there any other ini file where this could be loaded? Also, is /etc the correct location for php.ini on Windows? – Sven Aug 15 '11 at 9:39
I am running CentOS 5.6, with php-fpm & nginx. Not Windows. /etc/php.ini is the correct php.ini file. I have editted it in the past, and changes always worked. – Mr.Boon Aug 15 '11 at 9:52
Is there some subdirectory for PHP configurations in /etc or elsewhere that might get referenced in /etc/php.ini? On Linux, the extension for the library should be so, not dll. Maybe try grep -R /etc/* to find any line referencing this library. – Sven Aug 15 '11 at 10:08
nothing found. cant be found on the entire system. I did: whereis Also, i found my php extension dir: /opt/php/lib/php/extensions/no-debug-non-zts-20090626, and it only has in it. No other files. – Mr.Boon Aug 15 '11 at 10:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.