2016-04-15 07:59
浏览 229

通过php://输入原始POST,内容类型为multipart / form-data的表单无法正常工作

We have a proxy PHP script and access POST form data via

$postPayload = file_get_contents('php://input');

which usually works.

(The reason to not use $_POST is that we sometimes have duplicate form input names which PHP suppresses)

Now we have a form with

<form name="form" method="post" 
   action="/script.php" enctype="multipart/form-data">

In this case file_get_contents('php://input'); returns an empty string.

It can be reproduced with

curl 'http://localhost/script.php' -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8' -H 'Referer: http://localhost/script.php?commandCode=NO_AUTH_REGIST_OPEN_USER&amp;lang=de' -H 'Origin:' -H 'Upgrade-Insecure-Requests: 1' -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36' -H 'Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryk3IVneARm3kqJ0fs' --data-binary $'------WebKitFormBoundaryk3IVneARm3kqJ0fs
Content-Disposition: form-data; name="commandCode"

' --compressed

How can I access the RAW POST data in this case?

  • 写回答
  • 好问题 提建议
  • 关注问题
  • 收藏
  • 邀请回答

2条回答 默认 最新

  • doushuichong2589 2016-04-15 08:12

    multipart/form-data is not send to php://input, only to $_POST.

    In php.ini you can set enable-post-data-reading=off to change this but $_POST will always be empty. See

    You might set it for single pages using .htaccess

    php_value  enable-post-data-reading off

    There is also an apache hack:

    <Location "/backend/XXX.php">
        SetEnvIf Content-Type ^(multipart/form-data)(.*) NEW_CONTENT_TYPE=multipart/form-data-alternate$2 OLD_CONTENT_TYPE=$1$2
        RequestHeader set Content-Type %{NEW_CONTENT_TYPE}e env=NEW_CONTENT_TYPE

    See also: Get raw post data

    解决 无用
    打赏 举报
  • dqh1992 2016-04-15 08:17

    I was able to fix it like this in .htaccess

    <Files "script.php">
    # make post data always available in the proxy
    php_flag enable_post_data_reading 0
    解决 无用
    打赏 举报

相关推荐 更多相似问题