Security Considerations - Oracle 5.0 Reference Manual

the client-side. Because the plugins operates on their own layer below the PHP MySQL extensions,
they can monitor and change application actions without requiring application changes. If the PHP
MySQL extensions (mysqli, mysql, PDO_MYSQL) are compiled to use
• Monitoring
• Queries executed by any of the PHP MySQL extensions
• Prepared statements executing by any of the PHP MySQL extensions
• Auditing
• Detection of database usage
• SQL injection protection using black and white lists
• Assorted
• Load Balancing connections
The MySQL native driver for PHP (mysqlnd) features an internal plugin C API. C plugins, such as the
mysqlnd user handler plugin, can extend the functionality of mysqlnd. PECL/mysqlnd_uh makes parts
of the internal plugin C API available to the PHP user for plugin development with PHP.

20.7.8.1. Security considerations

Copyright 1997-2012 the PHP Documentation Group. [2230]
PECL/mysqlnd_uh gives users access to MySQL user names, MySQL password used by any of
the PHP MySQL extensions to connect to MySQL. It allows monitoring of all queries and prepared
statements exposing the statement string to the user. Therefore, the extension should be installed
with care. The
users from hooking mysqlnd calls.
Code obfuscators and similar technologies are not suitable to prevent monitoring of mysqlnd library
activities if PECL/mysqlnd_uh is made available and the user can install a proxy, for example, using
auto_prepend_file.
20.7.8.2. Documentation note
Copyright 1997-2012 the PHP Documentation Group. [2230]
Many of the mysqlnd_uh functions are briefly described because the
abstraction layer on top of the MySQL C API that the
corresponding
receive more information about a particular function.
20.7.8.3. On the name
Copyright 1997-2012 the PHP Documentation Group. [2230]
The shortcut
development.
20.7.8.4. Quickstart and Examples
Copyright 1997-2012 the PHP Documentation Group. [2230]
Mysqlnd user handler plugin (mysqlnd_uh)
Status
The mysqlnd user handler plugin is in alpha status. Take appropriate care
before using it in production environments.
configuration setting
PHP_INI_SYSTEM
mysqli documentation (along with the MySQL reference manual) can be consulted to
stands for
mysqlnd_uh
mysqlnd_uh.enable
mysqlnd
handler, and has been the name since early
mysqlnd user
2709
this can be used for:
mysqlnd
can be used to prevent
mysqli extension is a thin
library provides. Therefore, the