...There's a full write up/article detailing exactly what I did/how it works here:
PHP MySQL "instant" Audit Trail:
http://www.flatcoder.co.uk/php-mysql-instant-auditorauditing/
This came about when a client asked for a way to audit their system. The codebase was an old PHP application with more files/scripts that anyone would like to plough through!
The solution was a simple "drop in" replacement for the mysql_query call. From there, a simple search/replace on the codebase.
The auditor will capture "who did what" and "when". It is also smart enough to fully parse the raw MySQL query and compare updates to existing rows. Only actual changes are recorded in the audit log (database table) regardless of the SQL.
...