It seems the new hacker tool refref has been launched, and apparently it abuses a bug in the mysqli extension. Now I do not use mysqli at all for my websites, so i thought the best way to fight off this refref tool was to completely disable mysqli.

enter image description here

These are the settings i have set in my php.ini. Is there a way I can disable mysqli completely with having to recompile PHP?


mysqli.max_persistent = -1
;mysqli.allow_local_infile = On
mysqli.allow_persistent = On
mysqli.max_links = -1
mysqli.cache_size = 2000
mysqli.default_port = 3306
mysqli.default_socket =
mysqli.default_host =
mysqli.default_user =
mysqli.default_pw =
mysqli.reconnect = Off
  • check "Configuration File (php.ini) Path" on phpinfo, edit php.ini that you get from php.info, make sure commented ";extension=php_mysqli.dll". restart apache/iis – chocripple Aug 15 '11 at 9:28
  • the path shows, /etc/php.ini, which is the file i used to get the values displayed above from. – Mr.Boon Aug 15 '11 at 9:39
  • may be there is separate configuration that load extension=mysqli.so. just try grep -R mysqli.so /etc/. usually the extension on /usr/lib/php/modules/mysqli.so or /usr/lib64/php/modules/mysqli.so. – chocripple Aug 15 '11 at 10:17
  • The folder /usr/lib64/php/modules is there, but only contains phpcups.so, no other .so files. – Mr.Boon Aug 15 '11 at 10:29
  • weird. how about updatedb && locate mysqli.so ?. – chocripple Aug 15 '11 at 10:34

You probably have a pre-compiled mysqli extension

you can still disable functions by adding this to your php.ini:

disable_functions = mysqli_affected_rows,mysqli_autocommit,mysqli_change_user,mysqli_character_set_name,mysqli_close,mysqli_commit,mysqli_connect,mysqli_connect_errno,mysqli_connect_error,mysqli_data_seek,mysqli_dump_debug_info,mysqli_debug,mysqli_errno,mysqli_error,mysqli_stmt_execute,mysqli_execute,mysqli_fetch_field,mysqli_fetch_fields,mysqli_fetch_field_direct,mysqli_fetch_lengths,mysqli_fetch_all,mysqli_fetch_array,mysqli_fetch_assoc,mysqli_fetch_object,mysqli_fetch_row,mysqli_field_count,mysqli_field_seek,mysqli_field_tell,mysqli_free_result,mysqli_get_cache_stats,mysqli_get_connection_stats,mysqli_get_client_stats,mysqli_get_charset,mysqli_get_client_info,mysqli_get_client_version,mysqli_get_host_info,mysqli_get_proto_info,mysqli_get_server_info,mysqli_get_server_version,mysqli_get_warnings,mysqli_init,mysqli_info,mysqli_insert_id,mysqli_kill,mysqli_more_results,mysqli_multi_query,mysqli_next_result,mysqli_num_fields,mysqli_num_rows,mysqli_options,mysqli_ping,mysqli_poll,mysqli_prepare,mysqli_report,mysqli_query,mysqli_real_connect,mysqli_real_escape_string,mysqli_real_query,mysqli_reap_async_query,mysqli_rollback,mysqli_select_db,mysqli_set_charset,mysqli_stmt_affected_rows,mysqli_stmt_attr_get,mysqli_stmt_attr_set,mysqli_stmt_bind_param,mysqli_stmt_bind_result,mysqli_stmt_close,mysqli_stmt_data_seek,mysqli_stmt_errno,mysqli_stmt_error,mysqli_stmt_fetch,mysqli_stmt_field_count,mysqli_stmt_free_result,mysqli_stmt_get_result,mysqli_stmt_get_warnings,mysqli_stmt_init,mysqli_stmt_insert_id,mysqli_stmt_more_results,mysqli_stmt_next_result,mysqli_stmt_num_rows,mysqli_stmt_param_count,mysqli_stmt_prepare,mysqli_stmt_reset,mysqli_stmt_result_metadata,mysqli_stmt_send_long_data,mysqli_stmt_store_result,mysqli_stmt_sqlstate,mysqli_sqlstate,mysqli_ssl_set,mysqli_stat,mysqli_store_result,mysqli_thread_id,mysqli_thread_safe,mysqli_use_result,mysqli_warning_count,mysqli_refresh,mysqli_bind_param,mysqli_bind_result,mysqli_client_encoding,mysqli_escape_string,mysqli_fetch,mysqli_param_count,mysqli_get_metadata,mysqli_send_long_data,mysqli_set_opt

It is already deactivated. This is what the semicolon in front of the line


is for: It comments out the command to load this library.

  • Yeah i noticed in /etc/php.ini that its disabled already, but when I run <?php phpinfo(); ?> it is clearly enabled, as you can see from the screenshot. Also, var_dump(function_exists('mysqli_connect')); returns TRUE. – Mr.Boon Aug 15 '11 at 9:33
  • Is there any other ini file where this could be loaded? Also, is /etc the correct location for php.ini on Windows? – Sven Aug 15 '11 at 9:39
  • I am running CentOS 5.6, with php-fpm & nginx. Not Windows. /etc/php.ini is the correct php.ini file. I have editted it in the past, and changes always worked. – Mr.Boon Aug 15 '11 at 9:52
  • Is there some subdirectory for PHP configurations in /etc or elsewhere that might get referenced in /etc/php.ini? On Linux, the extension for the library should be so, not dll. Maybe try grep -R mysqli.so /etc/* to find any line referencing this library. – Sven Aug 15 '11 at 10:08
  • nothing found. mysqli.so cant be found on the entire system. I did: whereis mysqli.so. Also, i found my php extension dir: /opt/php/lib/php/extensions/no-debug-non-zts-20090626, and it only has memcache.so in it. No other files. – Mr.Boon Aug 15 '11 at 10:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.