<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h3 class="title">
      <a name="replication-privilege-checks">
      </a>
      19.3.3 Replication Privilege Checks
     </h3>
    </div>
   </div>
  </div>
  <div class="toc">
   <dl class="toc">
    <dt>
     <span class="section">
      <a href="replication-privilege-checks-account.html">
       19.3.3.1 Privileges For The Replication PRIVILEGE_CHECKS_USER Account
      </a>
     </span>
    </dt>
    <dt>
     <span class="section">
      <a href="replication-privilege-checks-gr.html">
       19.3.3.2 Privilege Checks For Group Replication Channels
      </a>
     </span>
    </dt>
    <dt>
     <span class="section">
      <a href="replication-privilege-checks-recover.html">
       19.3.3.3 Recovering From Failed Replication Privilege Checks
      </a>
     </span>
    </dt>
   </dl>
  </div>
  <p>
   By default, MySQL replication (including Group Replication) does
      not carry out privilege checks when transactions that were already
      accepted by another server are applied on a replica or group
      member. You can create a user account with the appropriate
      privileges to apply the transactions that are normally replicated
      on a channel, and specify this as the
   <code class="literal">
    PRIVILEGE_CHECKS_USER
   </code>
   account for the
      replication applier, using a
   <a class="link" href="change-replication-source-to.html" title="15.4.2.2 CHANGE REPLICATION SOURCE TO Statement">
    <code class="literal">
     CHANGE
      REPLICATION SOURCE TO
    </code>
   </a>
   statement. MySQL then checks each
      transaction against the user account's privileges to verify
      that you have authorized the operation for that channel. The
      account can also be safely used by an administrator to apply or
      reapply transactions from
   <a class="link" href="mysqlbinlog.html" title="6.6.9 mysqlbinlog — Utility for Processing Binary Log Files">
    <span class="command">
     <strong>
      mysqlbinlog
     </strong>
    </span>
   </a>
   output,
      for example to recover from a replication error on the channel.
  </p>
  <p>
   The use of a
   <code class="literal">
    PRIVILEGE_CHECKS_USER
   </code>
   account
      helps secure a replication channel against the unauthorized or
      accidental use of privileged or unwanted operations. The
   <code class="literal">
    PRIVILEGE_CHECKS_USER
   </code>
   account provides an
      additional layer of security in situations such as these:
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      You are replicating between a server instance on your
          organization's network, and a server instance on another
          network, such as an instance supplied by a cloud service
          provider.
     </p>
    </li>
    <li class="listitem">
     <p>
      You want to have multiple on-premise or off-site deployments
          administered as separate units, without giving one
          administrator account privileges on all the deployments.
     </p>
    </li>
    <li class="listitem">
     <p>
      You want to have an administrator account that enables an
          administrator to perform only operations that are directly
          relevant to the replication channel and the databases it
          replicates, rather than having wide privileges on the server
          instance.
     </p>
    </li>
   </ul>
  </div>
  <p>
   You can increase the security of a replication channel where
      privilege checks are applied by adding one or both of these
      options to the
   <a class="link" href="change-replication-source-to.html" title="15.4.2.2 CHANGE REPLICATION SOURCE TO Statement">
    <code class="literal">
     CHANGE REPLICATION SOURCE
      TO
    </code>
   </a>
   statement when you specify the
   <code class="literal">
    PRIVILEGE_CHECKS_USER
   </code>
   account for the channel:
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      The
      <code class="literal">
       REQUIRE_ROW_FORMAT
      </code>
      option makes the
          replication channel accept only row-based replication events.
          When
      <code class="literal">
       REQUIRE_ROW_FORMAT
      </code>
      is set, you must
          use row-based binary logging
          (
      <a class="link" href="replication-options-binary-log.html#sysvar_binlog_format">
       <code class="literal">
        binlog_format=ROW
       </code>
      </a>
      ) on the
          source server. With statement-based binary logging, some
          administrator-level privileges might be required for the
      <code class="literal">
       PRIVILEGE_CHECKS_USER
      </code>
      account to execute
          transactions successfully.
     </p>
    </li>
    <li class="listitem">
     <p>
      The
      <code class="literal">
       REQUIRE_TABLE_PRIMARY_KEY_CHECK
      </code>
      option
          makes the replication channel use its own policy for primary
          key checks. Setting
      <code class="literal">
       ON
      </code>
      means that primary
          keys are always required, and setting
      <code class="literal">
       OFF
      </code>
      means that primary keys are never required. The default
          setting,
      <code class="literal">
       STREAM
      </code>
      , sets the session value of
          the
      <a class="link" href="server-system-variables.html#sysvar_sql_require_primary_key">
       <code class="literal">
        sql_require_primary_key
       </code>
      </a>
      system variable using the value that is replicated from the
          source for each transaction. When
      <code class="literal">
       PRIVILEGE_CHECKS_USER
      </code>
      is set, setting
      <code class="literal">
       REQUIRE_TABLE_PRIMARY_KEY_CHECK
      </code>
      to either
      <code class="literal">
       ON
      </code>
      or
      <code class="literal">
       OFF
      </code>
      means that the
          user account does not need session administration level
          privileges to set restricted session variables, which are
          required to change the value of
      <a class="link" href="server-system-variables.html#sysvar_sql_require_primary_key">
       <code class="literal">
        sql_require_primary_key
       </code>
      </a>
      . It
          also normalizes the behavior across replication channels for
          different sources.
     </p>
    </li>
   </ul>
  </div>
  <p>
   You grant the
   <a class="link" href="privileges-provided.html#priv_replication-applier">
    <code class="literal">
     REPLICATION_APPLIER
    </code>
   </a>
   privilege to enable a user account to appear as the
   <code class="literal">
    PRIVILEGE_CHECKS_USER
   </code>
   for a replication applier
      thread, and to execute the internal-use
   <a class="link" href="binlog.html" title="15.7.8.1 BINLOG Statement">
    <code class="literal">
     BINLOG
    </code>
   </a>
   statements used by
      mysqlbinlog. The user name and host name for the
   <code class="literal">
    PRIVILEGE_CHECKS_USER
   </code>
   account must follow the
      syntax described in
   <a class="xref" href="account-names.html" title="8.2.4 Specifying Account Names">
    Section 8.2.4, “Specifying Account Names”
   </a>
   , and the user
      must not be an anonymous user (with a blank user name) or the
   <code class="literal">
    CURRENT_USER
   </code>
   . To create a new account, use
   <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
    <code class="literal">
     CREATE USER
    </code>
   </a>
   . To grant this account
      the
   <a class="link" href="privileges-provided.html#priv_replication-applier">
    <code class="literal">
     REPLICATION_APPLIER
    </code>
   </a>
   privilege,
      use the
   <a class="link" href="grant.html" title="15.7.1.6 GRANT Statement">
    <code class="literal">
     GRANT
    </code>
   </a>
   statement. For
      example, to create a user account
   <code class="literal">
    priv_repl
   </code>
   ,
      which can be used manually by an administrator from any host in
      the
   <code class="literal">
    example.com
   </code>
   domain, and requires an
      encrypted connection, issue the following statements:
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa21760136"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">SET</span> sql_log_bin <span class="token operator">=</span> <span class="token number">0</span><span class="token punctuation">;</span>
<span class="token prompt">mysql&gt;</span> <span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'priv_repl'</span>@<span class="token string">'%.example.com'</span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">BY</span> <span class="token string">'<em class="replaceable">password</em>'</span> <span class="token keyword">REQUIRE</span> <span class="token keyword">SSL</span><span class="token punctuation">;</span>
<span class="token prompt">mysql&gt;</span> <span class="token keyword">GRANT</span> REPLICATION_APPLIER <span class="token keyword">ON</span> <span class="token operator">*</span><span class="token punctuation">.</span><span class="token operator">*</span> <span class="token keyword">TO</span> <span class="token string">'priv_repl'</span>@<span class="token string">'%.example.com'</span><span class="token punctuation">;</span>
<span class="token prompt">mysql&gt;</span> <span class="token keyword">SET</span> sql_log_bin <span class="token operator">=</span> <span class="token number">1</span><span class="token punctuation">;</span></code></pre>
  </div>
  <p>
   The
   <code class="literal">
    SET sql_log_bin
   </code>
   statements are used so that
      the account management statements are not added to the binary log
      and sent to the replication channels (see
   <a class="xref" href="set-sql-log-bin.html" title="15.4.1.3 SET sql_log_bin Statement">
    Section 15.4.1.3, “SET sql_log_bin Statement”
   </a>
   ).
  </p>
  <div class="important" style="margin-left: 0.5in; margin-right: 0.5in;">
   <div class="admon-title">
    Important
   </div>
   <p>
    The
    <code class="literal">
     caching_sha2_password
    </code>
    authentication
        plugin is the default for new users (for details, see
    <a class="xref" href="caching-sha2-pluggable-authentication.html" title="8.4.1.2 Caching SHA-2 Pluggable Authentication">
     Section 8.4.1.2, “Caching SHA-2 Pluggable Authentication”
    </a>
    ). To
        connect to a server using a user account that authenticates with
        this plugin, you must either set up an encrypted connection as
        described in
    <a class="xref" href="replication-encrypted-connections.html" title="19.3.1 Setting Up Replication to Use Encrypted Connections">
     Section 19.3.1, “Setting Up Replication to Use Encrypted Connections”
    </a>
    , or enable
        the unencrypted connection to support password exchange using an
        RSA key pair.
   </p>
  </div>
  <p>
   After setting up the user account, use the
   <a class="link" href="grant.html" title="15.7.1.6 GRANT Statement">
    <code class="literal">
     GRANT
    </code>
   </a>
   statement to grant additional
      privileges to enable the user account to make the database changes
      that you expect the applier thread to carry out, such as updating
      specific tables held on the server. These same privileges enable
      an administrator to use the account if they need to execute any of
      those transactions manually on the replication channel. If an
      unexpected operation is attempted for which you did not grant the
      appropriate privileges, the operation is disallowed and the
      replication applier thread stops with an error.
   <a class="xref" href="replication-privilege-checks-account.html" title="19.3.3.1 Privileges For The Replication PRIVILEGE_CHECKS_USER Account">
    Section 19.3.3.1, “Privileges For The Replication PRIVILEGE_CHECKS_USER Account”
   </a>
   explains
      what additional privileges the account needs. For example, to
      grant the
   <code class="literal">
    priv_repl
   </code>
   user account the
   <a class="link" href="privileges-provided.html#priv_insert">
    <code class="literal">
     INSERT
    </code>
   </a>
   privilege to add rows to the
   <code class="literal">
    cust
   </code>
   table in
   <code class="literal">
    db1
   </code>
   , issue the
      following statement:
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa20609017"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">GRANT</span> <span class="token keyword">INSERT</span> <span class="token keyword">ON</span> db1<span class="token punctuation">.</span>cust <span class="token keyword">TO</span> <span class="token string">'priv_repl'</span>@<span class="token string">'%.example.com'</span><span class="token punctuation">;</span></code></pre>
  </div>
  <p>
   You assign the
   <code class="literal">
    PRIVILEGE_CHECKS_USER
   </code>
   account
      for a replication channel using a
   <a class="link" href="change-replication-source-to.html" title="15.4.2.2 CHANGE REPLICATION SOURCE TO Statement">
    <code class="literal">
     CHANGE
      REPLICATION SOURCE TO
    </code>
   </a>
   statement. If replication is
      running, issue
   <a class="link" href="stop-replica.html" title="15.4.2.5 STOP REPLICA Statement">
    <code class="literal">
     STOP REPLICA
    </code>
   </a>
   before
      the
   <a class="link" href="change-replication-source-to.html" title="15.4.2.2 CHANGE REPLICATION SOURCE TO Statement">
    <code class="literal">
     CHANGE REPLICATION SOURCE TO
    </code>
   </a>
   statement, and
   <a class="link" href="start-replica.html" title="15.4.2.4 START REPLICA Statement">
    <code class="literal">
     START REPLICA
    </code>
   </a>
   after
      it. The use of row-based binary logging is strongly recommended
      when
   <code class="literal">
    PRIVILEGE_CHECKS_USER
   </code>
   is set; you can use
      the statement to set
   <code class="literal">
    REQUIRE_ROW_FORMAT
   </code>
   to
      enforce this.
  </p>
  <p>
   When you restart the replication channel, checks on dynamic
      privileges are applied from that point on. However, static global
      privileges are not active in the applier's context until you
      reload the grant tables, because these privileges are not changed
      for a connected client. To activate static privileges, perform a
      flush-privileges operation. This can be done by issuing a
   <a class="link" href="flush.html#flush-privileges">
    <code class="literal">
     FLUSH PRIVILEGES
    </code>
   </a>
   statement or by
      executing a
   <a class="link" href="mysqladmin.html" title="6.5.2 mysqladmin — A MySQL Server Administration Program">
    <span class="command">
     <strong>
      mysqladmin flush-privileges
     </strong>
    </span>
   </a>
   or
   <a class="link" href="mysqladmin.html" title="6.5.2 mysqladmin — A MySQL Server Administration Program">
    <span class="command">
     <strong>
      mysqladmin reload
     </strong>
    </span>
   </a>
   command.
  </p>
  <p>
   For example, to start privilege checks on the channel
   <code class="literal">
    channel_1
   </code>
   on a running replica, issue the
      following statements:
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa47531897"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">STOP</span> <span class="token keyword">REPLICA</span> <span class="token keyword">FOR</span> <span class="token keyword">CHANNEL</span> <span class="token string">'channel_1'</span><span class="token punctuation">;</span>
<span class="token prompt">mysql&gt;</span> <span class="token keyword">CHANGE</span> <span class="token keyword">REPLICATION</span> <span class="token keyword">SOURCE</span> <span class="token keyword">TO</span>
     <span class="token operator">&gt;</span>    <span class="token keyword">PRIVILEGE_CHECKS_USER</span> <span class="token operator">=</span> <span class="token string">'priv_repl'</span>@<span class="token string">'%.example.com'</span><span class="token punctuation">,</span>
     <span class="token operator">&gt;</span>    <span class="token keyword">REQUIRE_ROW_FORMAT</span> <span class="token operator">=</span> <span class="token number">1</span> <span class="token keyword">FOR</span> <span class="token keyword">CHANNEL</span> <span class="token string">'channel_1'</span><span class="token punctuation">;</span>
<span class="token prompt">mysql&gt;</span> <span class="token keyword">FLUSH</span> <span class="token keyword">PRIVILEGES</span><span class="token punctuation">;</span>
<span class="token prompt">mysql&gt;</span> <span class="token keyword">START</span> <span class="token keyword">REPLICA</span> <span class="token keyword">FOR</span> <span class="token keyword">CHANNEL</span> <span class="token string">'channel_1'</span><span class="token punctuation">;</span></code></pre>
  </div>
  <p>
   If you do not specify a channel and no other channels exist, the
      statement is applied to the default channel. The user name and
      host name for the
   <code class="literal">
    PRIVILEGE_CHECKS_USER
   </code>
   account
      for a channel are shown in the Performance Schema
   <a class="link" href="performance-schema-replication-applier-configuration-table.html" title="29.12.11.2 The replication_applier_configuration Table">
    <code class="literal">
     replication_applier_configuration
    </code>
   </a>
   table, where they are properly escaped so they can be copied
      directly into SQL statements to execute individual transactions.
  </p>
  <p>
   If you are using the
   <code class="literal">
    Rewriter
   </code>
   plugin, you
      should grant the
   <code class="literal">
    PRIVILEGE_CHECKS_USER
   </code>
   user
      account the
   <a class="link" href="privileges-provided.html#priv_skip-query-rewrite">
    <code class="literal">
     SKIP_QUERY_REWRITE
    </code>
   </a>
   privilege. This prevents statements issued by this user from being
      rewritten. See
   <a class="xref" href="rewriter-query-rewrite-plugin.html" title="7.6.4 The Rewriter Query Rewrite Plugin">
    Section 7.6.4, “The Rewriter Query Rewrite Plugin”
   </a>
   ,
      for more information.
  </p>
  <p>
   When
   <code class="literal">
    REQUIRE_ROW_FORMAT
   </code>
   is set for a
      replication channel, the replication applier does not create or
      drop temporary tables, and so does not set the
   <a class="link" href="server-system-variables.html#sysvar_pseudo_thread_id">
    <code class="literal">
     pseudo_thread_id
    </code>
   </a>
   session system
      variable. It does not execute
   <code class="literal">
    LOAD DATA INFILE
   </code>
   instructions, and so does not attempt file operations to access or
      delete the temporary files associated with data loads (logged as a
   <code class="literal">
    Format_description_log_event
   </code>
   ). It does not
      execute
   <code class="literal">
    INTVAR
   </code>
   ,
   <code class="literal">
    RAND
   </code>
   , and
   <code class="literal">
    USER_VAR
   </code>
   events, which are used to reproduce
      the client's connection state for statement-based replication. (An
      exception is
   <code class="literal">
    USER_VAR
   </code>
   events that are
      associated with DDL queries, which are executed.) It does not
      execute any statements that are logged within DML transactions. If
      the replication applier detects any of these types of event while
      attempting to queue or apply a transaction, the event is not
      applied, and replication stops with an error.
  </p>
  <p>
   You can set
   <code class="literal">
    REQUIRE_ROW_FORMAT
   </code>
   for a
      replication channel whether or not you set a
   <code class="literal">
    PRIVILEGE_CHECKS_USER
   </code>
   account. The restrictions
      implemented when you set this option increase the security of the
      replication channel even without privilege checks. You can also
      specify the
   <code class="option">
    --require-row-format
   </code>
   option when you
      use
   <a class="link" href="mysqlbinlog.html" title="6.6.9 mysqlbinlog — Utility for Processing Binary Log Files">
    <span class="command">
     <strong>
      mysqlbinlog
     </strong>
    </span>
   </a>
   , to enforce row-based
      replication events in
   <a class="link" href="mysqlbinlog.html" title="6.6.9 mysqlbinlog — Utility for Processing Binary Log Files">
    <span class="command">
     <strong>
      mysqlbinlog
     </strong>
    </span>
   </a>
   output.
  </p>
  <p>
   <b>
    Security Context.
   </b>
   By default, when a replication applier thread is started with a
        user account specified as the
   <code class="literal">
    PRIVILEGE_CHECKS_USER
   </code>
   , the security context
        is created using default roles, or with all roles if
   <a class="link" href="server-system-variables.html#sysvar_activate_all_roles_on_login">
    <code class="literal">
     activate_all_roles_on_login
    </code>
   </a>
   is
        set to
   <code class="literal">
    ON
   </code>
   .
  </p>
  <p>
   You can use roles to supply a general privilege set to accounts
      that are used as
   <code class="literal">
    PRIVILEGE_CHECKS_USER
   </code>
   accounts, as in the following example. Here, instead of granting
      the
   <a class="link" href="privileges-provided.html#priv_insert">
    <code class="literal">
     INSERT
    </code>
   </a>
   privilege for the
   <code class="literal">
    db1.cust
   </code>
   table directly to a user account as in
      the earlier example, this privilege is granted to the role
   <code class="literal">
    priv_repl_role
   </code>
   along with the
   <a class="link" href="privileges-provided.html#priv_replication-applier">
    <code class="literal">
     REPLICATION_APPLIER
    </code>
   </a>
   privilege. The
      role is then used to grant the privilege set to two user accounts,
      both of which can now be used as
   <code class="literal">
    PRIVILEGE_CHECKS_USER
   </code>
   accounts:
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa94585178"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">SET</span> sql_log_bin <span class="token operator">=</span> <span class="token number">0</span><span class="token punctuation">;</span>
<span class="token prompt">mysql&gt;</span> <span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'priv_repa'</span>@<span class="token string">'%.example.com'</span>
                  <span class="token keyword">IDENTIFIED</span> <span class="token keyword">BY</span> <span class="token string">'<em class="replaceable">password</em>'</span>
                  <span class="token keyword">REQUIRE</span> <span class="token keyword">SSL</span><span class="token punctuation">;</span>
<span class="token prompt">mysql&gt;</span> <span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'priv_repb'</span>@<span class="token string">'%.example.com'</span>
                  <span class="token keyword">IDENTIFIED</span> <span class="token keyword">BY</span> <span class="token string">'<em class="replaceable">password</em>'</span>
                  <span class="token keyword">REQUIRE</span> <span class="token keyword">SSL</span><span class="token punctuation">;</span>
<span class="token prompt">mysql&gt;</span> <span class="token keyword">CREATE</span> <span class="token keyword">ROLE</span> <span class="token string">'priv_repl_role'</span><span class="token punctuation">;</span>
<span class="token prompt">mysql&gt;</span> <span class="token keyword">GRANT</span> REPLICATION_APPLIER <span class="token keyword">TO</span> <span class="token string">'priv_repl_role'</span><span class="token punctuation">;</span>
<span class="token prompt">mysql&gt;</span> <span class="token keyword">GRANT</span> <span class="token keyword">INSERT</span> <span class="token keyword">ON</span> db1<span class="token punctuation">.</span>cust <span class="token keyword">TO</span> <span class="token string">'priv_repl_role'</span><span class="token punctuation">;</span>
<span class="token prompt">mysql&gt;</span> <span class="token keyword">GRANT</span> <span class="token string">'priv_repl_role'</span> <span class="token keyword">TO</span>
                  <span class="token string">'priv_repa'</span>@<span class="token string">'%.example.com'</span><span class="token punctuation">,</span>
                  <span class="token string">'priv_repb'</span>@<span class="token string">'%.example.com'</span><span class="token punctuation">;</span>
<span class="token prompt">mysql&gt;</span> <span class="token keyword">SET</span> <span class="token keyword">DEFAULT</span> <span class="token keyword">ROLE</span> <span class="token string">'priv_repl_role'</span> <span class="token keyword">TO</span>
                  <span class="token string">'priv_repa'</span>@<span class="token string">'%.example.com'</span><span class="token punctuation">,</span>
                  <span class="token string">'priv_repb'</span>@<span class="token string">'%.example.com'</span><span class="token punctuation">;</span>
<span class="token prompt">mysql&gt;</span> <span class="token keyword">SET</span> sql_log_bin <span class="token operator">=</span> <span class="token number">1</span><span class="token punctuation">;</span></code></pre>
  </div>
  <p>
   Be aware that when the replication applier thread creates the
      security context, it checks the privileges for the
   <code class="literal">
    PRIVILEGE_CHECKS_USER
   </code>
   account, but does not
      carry out password validation, and does not carry out checks
      relating to account management, such as checking whether the
      account is locked. The security context that is created remains
      unchanged for the lifetime of the replication applier thread.
  </p>
 </div>
 <br/>
</div>
