php curl vs cli curl, posting xml

Question

UPDATED THANKS TO ANSWERS:

Can someone point out the difference between:

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $api_root);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, "xml"); // tried http_build_query also
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); // Added this, still no good
return curl_exec($ch);  // returns false

and:

$curl = "curl -X POST -d 'xml' {$api_root}";
return `$curl`;  // returns expected xml from server

AND/OR

More generally, are there any good breakdowns out there for conversion/reference between php's libcurl default values/headers and those of curl on the command line?

I know this is almost a dupe of curl CLI to curl PHP and CLI CURL -> PHP CURL but I'm hoping for something more definitive.

Answer 1

When you use backticks then PHP invokes a shell. This can be dangerous, especially when you include variables in the command. If someone has a way to influence the value of $api_root they would be able to invoke any command on your system.

Using the API is much safer and probably faster as well as the curl libraries are loaded into PHP.

As for why it's not working it seems others have answered that question :)