Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

What's the difference between php://input and php://stdin

Similarly what is the difference between php://output and php://stdout?

I was trying to figure out how servers provide php://input and php://output. The only way I could think of (given that both php://input and php://output are independent of the mysterious php.ini file according to this page in the manual) would be to change stdin and stdout to both refer to the connection socket's file descriptor. But then to my chagrin I found out that php://stdin and php://stdout were also defined - presumably in a different way.

Is this just redundancy or do these file names actually refer to do different things? Can someone tell me what's going on here?

like image 244
William Rosenbloom Avatar asked Dec 15 '15 00:12

William Rosenbloom


People also ask

What is php stdin?

php://stdin, php://stdout and php://stderr allow direct access to standard input stream device, standard output stream and error stream to a PHP process respectively. Predefined constants STDIN, STDOUT and STDERR respectively represent these streams.

What is stdin and stdout in php?

php://stdin, php://stdout and php://stderr allow direct access to the corresponding input or output stream of the PHP process. The stream references a duplicate file descriptor, so if you open php://stdin and later close it, you close only your copy of the descriptor-the actual stream referenced by STDIN is unaffected.

What is php filter resource?

php://filter allows a pen tester to include local files and base64 encodes the output. Therefore, any base64 output will need to be decoded to reveal the contents. An example using DVWA: vuln.php? page=php://filter/convert.base64-encode/resource=/etc/passwd.


1 Answers

The difference is in the environment where you're expected to use them. php://stdin, php://stdout, and php://stderr are mapped directly to the relevant POSIX file streams and are intended for use with the CLI SAPI. On the other hand, php://input and php://output are intended for use with web-based SAPIs.

Try running these two commands from the command line:

printf "foo" | php -r "var_dump(file_get_contents('php://stdin'));"

printf "foo" | php -r "var_dump(file_get_contents('php://input'));"

You're going to get output like this:

Command line code:1:
string(3) "foo"

Command line code:1:
string(0) ""

Because php://input expects to be used by a web SAPI like CGI or mod_php and will not get the contents of STDIN passed to it. Likewise, trying to read raw POST data (the only real use for php://input) using php://stdin would fail.

php://output can generally be used in both environments but it's rarely used at all, since one can simply echo output. php://stdout is the more logical choice for command line code, though again it's generally easier to just use echo.

php://stderr is of course invaluable to command line programmers who need to output informational, debug, or error messages to a different stream than the program output.

like image 66
miken32 Avatar answered Nov 10 '22 00:11

miken32