php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #9434 php-cgi is unable to parse GET request on command line properly
Submitted: 2001-02-24 04:33 UTC Modified: 2005-09-02 07:32 UTC
From: sagawa at sohgoh dot net Assigned:
Status: Closed Package: *General Issues
PHP Version: 4.0.4 OS: Any
Private report: No CVE-ID: None
 [2001-02-24 04:33 UTC] sagawa at sohgoh dot net
I get funny $HTTP_GET_VARS passed by command line argument
query_string,
on PHP 4.0.4(as far as I know :) with cgi-sapi.

This is sample for this problem.
test.php is <?php var_dump($HTTP_GET_VARS); ?>
and run from command line.

% php -f test.php 'AAA=xx&BB=yy' 'CC=zz'
array(2) {
  ["test_php_AAA"]=>
  string(2) "xx"
  ["BB"]=>
  string(8) "yy CC=zz"
}

`AAA' is connected with file name,
and inserted space between arguments.
(test.php was changed to test_php because of php variable
name restriction.)

So, I modify sapi/cgi/cgi_main.c.
% diff -u cgi_main.c~ cgi_main.c
--- cgi_main.c~ Sun Dec  3 10:09:13 2000
+++ cgi_main.c  Thu Feb 22 21:20:47 2001
@@ -649,14 +649,10 @@

                        s = malloc(len + 1);    /* leak -
but only for command line version, so ok */
                        *s = '\0';                      /*
we are pretending it came from the environment  */
-                       if (script_file) {
-                               strcpy(s, script_file);
-                               strcat(s, "+");
-                       }
                        for (i = ap_php_optind, len = 0; i <
argc; i++) {
                                strcat(s, argv[i]);
                                if (i < (argc - 1)) {
-                                       strcat(s, "+");
+                                       strcat(s,
PG(arg_separator));
                                }
                        }
                        SG(request_info).query_string = s;

This works fine, like...
% php -f test.php 'AAA=xx&BB=yy' 'CC=zz'
array(3) {
  ["AAA"]=>
  string(2) "xx"
  ["BB"]=>
  string(2) "yy"
  ["CC"]=>
  string(2) "zz"
} 

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2001-03-15 12:22 UTC] sagawa at sohgoh dot net
I withdraw this patch. Because, it turns out that this patch
have a bad influence on argument variables. All argvs are
connected to only argv[0], so we can't get argv[2] and so on.
I am thankful to Mr.Hirokawa who pointed out this.

 [2002-06-15 10:13 UTC] mfischer@php.net
This issue is still valid and should be addressed before 4.3.0:

C:\php\latest>type test.php
<?
        echo "\$_GET: \n";
        var_dump($_GET);
        echo "\n\$argv: \n";
        var_dump($_SERVER['argv']);
?>

C:\php\latest>php-cgi -v
PHP 4.3.0-dev (cgi), Copyright (c) 1997-2002 The PHP Group
Zend Engine v1.2.1, Copyright (c) 1998-2002 Zend Technologies

C:\php\latest>php-cgi -f test.php "a=1" "b=2" "c=3&d=4"
$_GET:
array(2) {
  ["test_php_a"]=>
  string(9) "1 b=2 c=3"
  ["d"]=>
  string(1) "4"
}

$argv:
array(4) {
  [0]=>
  string(8) "test.php"
  [1]=>
  string(3) "a=1"
  [2]=>
  string(3) "b=2"
  [3]=>
  string(7) "c=3&d=4"
}

Obviously, the "test_php_a" entry in $_GET is wrong. This is because internal this is translated to "test.php?a=1" and since "." and "?" are not allowed in variable names they're converted to "_". The patch above is not sufficient.

A few things have to be considered for consistence: the $_SERVER['argv'] should always containt the right parameters too (i.e. if someone fixed the $_GET issue, $_SERVER['argv'] should still work. If you take a look at the source (cgi_main.c and main/main.c in php_build_argv you'll soon see what I mean).

The purpose of this is to have the ability to run CGI written scripts from the shell and be able to pass the same GET request to the script.
 [2002-06-15 19:29 UTC] sniper@php.net
let's make it critical so it's not forgotten.
(hopefully)

 [2005-09-02 07:32 UTC] sniper@php.net
Fixed in current versions. (this was forgotten after all, due to a bug in our bug system :)

 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved.
Last updated: Wed May 07 16:01:30 2025 UTC