Statement on glibc/iconv Vulnerability

    输入输出流

    CLI SAPI 为 I/O 流定义了一些常量，以使命令行变量编程更容易一些。

    CLI 特定常量
    常量 描述
    STDIN

    已经打开的 stdin 流。使得无需再用以下方式打开：

    <?php
    $stdin     = fopen('php://stdin', 'r');
    ?>
    如果想从 stdin 中读取一行内容，可以使用如下方式：
    <?php
    $line     = trim(fgets(STDIN)); // 从 STDIN 读取一行
    fscanf(STDIN, "%d\n", $number); // 从 STDIN 读取数字
    ?>
    STDOUT

    已经打开的 stdout 流。使得无需再用以下方式打开：

    <?php
    $stdout     = fopen('php://stdout', 'w');
    ?>
    STDERR

    已经打开的 stderr 流。使得无需再用以下方式打开：

    <?php
    $stderr     = fopen('php://stderr', 'w');
    ?>

    综上所述，则无需打开 stderr 流，只需使用常量代替流资源： 

    php -r 'fwrite(STDERR, "stderr\n");'
    无须显式关闭这些流，因为它们会在脚本结束时由 PHP 自动关闭。

    注意:

    如果从 stdin 中读取 PHP 脚本，则这些常量不可用。

    Improve This Page

    Learn How To Improve This Page • Submit a Pull Request • Report a Bug
    ＋add a note

    User Contributed Notes 5 notes

    up
    34
    Aurelien Marchand
    13 years ago
    Please remember in multi-process applications (which are best suited under CLI), that I/O operations often will BLOCK signals from being processed.

    For instance, if you have a parent waiting on fread(STDIN), it won't handle SIGCHLD, even if you defined a signal handler for it, until after the call to fread has returned.

    Your solution in this case is to wait on stream_select() to find out whether reading will block. Waiting on stream_select(), critically, does NOT BLOCK signals from being processed.

    Aurelien
    up
    17
    phil_php at zieaon dot com
    5 years ago
    The command line interface data in STDIN is not made available until return is pressed.
    By adding "readline_callback_handler_install('', function(){});" before reading STDIN for the first time single key presses can be captured.

    Note: This only seems to work under Linux CLI and will not work in Apache or Windows CLI.

    This cam be used to obscure a password or used with 'stream_select' to make a non blocking keyboard monitor.

    <?php

    // Demo WITHOUT readline_callback_handler_install('', function(){});
    $resSTDIN=fopen("php://stdin","r");
    echo(    "Type 'x'. Then press return.");
    $strChar = stream_get_contents($resSTDIN, 1);

    echo(    "\nYou typed: ".$strChar."\n\n");
    fclose($resSTDIN);

    // Demo WITH readline_callback_handler_install('', function(){});
    // This line removes the wait for <CR> on STDIN
    readline_callback_handler_install('', function(){});

    $resSTDIN=fopen("php://stdin","r");
    echo(    "We have now run: readline_callback_handler_install('', function(){});\n");
    echo(    "Press the 'y' key");
    $strChar = stream_get_contents($resSTDIN, 1);
    echo(    "\nYou pressed: ".$strChar."\nBut did not have to press <cr>\n");
    fclose($resSTDIN);
    readline_callback_handler_remove ();
    echo(    "\nGoodbye\n")
    ?>

    It also hides text from the CLI so can be used for things like. password obscurification.
    eg

    <?php
    readline_callback_handler_install    ('', function(){});
    echo(    "Enter password followed by return. (Do not use a real one!)\n");
    echo(    "Password: ");
    $strObscured='';
    while(    true)
    {
    $strChar = stream_get_contents(STDIN, 1);
    if(    $strChar===chr(10))
    {
    break;
    }
    $strObscured.=$strChar;
    echo(    "*");
    }
    echo(    "\n");
    echo(    "You entered: ".$strObscured."\n");
    ?>
    up
    10
    ecrist at secure-computing dot net
    12 years ago
    The following code shows how to test for input on STDIN. In this case, we were looking for CSV data, so we use fgetcsv to read STDIN, if it creates an array, we assume CVS input on STDIN, if no array was created, we assume there's no input from STDIN, and look, later, to an argument with a CSV file name.

    Note, without the stream_set_blocking() call, fgetcsv() hangs on STDIN, awaiting input from the user, which isn't useful as we're looking for a piped file. If it isn't here already, it isn't going to be.

    <?php
    stream_set_blocking    (STDIN, 0);
    $csv_ar = fgetcsv(STDIN);
    if (    is_array($csv_ar)){
    print     "CVS on STDIN\n";
    } else {
    print     "Look to ARGV for CSV file name.\n";
    }
    ?>
    up
    1
    phil_php at zieaon dot com
    3 years ago
    Under Linux CLI - STDIN, STDOUT and STDERR can be closed and reconnected to a different php stream such as a file, pipe or even a UDP socket_stream. (I use this technique to send the output/errors of my long running background scripts to a file so I can debug if something goes wrong.)

    For example: (The below creates/appends file "/tmp/php_stdout.txt")
    <?php
    // This only works under CLI in Linux
    // Note: Until we have closed it STDOUT will NOT be prefixed with a $

    // Get the path to the current console for STDOUT so we can reconnect later!
    $strOldSTDOUT=(posix_ttyname(STDOUT));

    echo(    "This will go to the current console\r\n");
    // Close the STDOUT resource
    fclose(STDOUT);

    // Reopen $STDOUT as a file Note: All further $STDOUT usage will be prefixed with a $
    $STDOUT=fopen("/tmp/php_stdout.txt","a"); /
    echo(    "This should append the file /tmp/php_stdout.txt\r\n");
    // Close stdout again so we can reconnect the console. Note: We are still using
    fclose($STDOUT);

    // Use the path to the console we got earlier
    $STDOUT=fopen($strOldSTDOUT,"r+");
    echo(    "And we are back on the console\r\n");

    ?>
    up
    -10
    ayon at hyurl dot com
    7 years ago
    I find a BUG with the constant STDIN, I don't know if it si the Enter/Return key that make this proprem, when I use trim(fgets(STDIN)), that doesn't trim anything, when I detect the length of fgets(STDIN), in windows, it is 2 characters longer than what I input, in Linux, it makes 1. I tried to trim(fgets(STDIN), ' \r\n'), but it still does not work.
    So I have to substr the input manually, it seems like this way:
    <?php
    $STDIN     = trim(substr(fgets(STDIN), 0, (PHP_OS == 'WINNT' ? 2 : 1)));
    ?>
    then I get what I want really.
    ＋add a note
    To Top