为什么cURL在POST时解码我的URL编码值？

Question

When using cURL to send data via POST, if that data string is URL encoded or if parts of it are URL encoded, cURL automatically decodes the data when sending it.

This happens when using cURL in PHP or directly in the command line.

I've tested with 2 different version of cURL: 7.19 and 7.49. Both exhibit the same behavior

I've sent the cURL request from two different servers thinking that the the way the servers was configured somehow influenced this, but the result was the same.

Here is a simple PHP cURL request that I've used for my test:

$ua = 'Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/525.13 (KHTML, like Gecko) Chrome/0.A.B.C Safari/525.13';

$data = "https%3A%2F%2Fexample.com%3A8081%2Ftemoignez%3FQid%3D%26"       

$ch = curl_init( "https://example.com/test/webhook.php" );
curl_setopt($ch, CURLOPT_USERAGENT, $ua);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, "payload=".$data);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);

$response = curl_exec( $ch );

The data will be sent decoded even though the initial string is URL encoded.

I'm retrieving the data by dumping the POST data into a file on disk using PHP.

Is this normal? Any idea what may cause this?

Answer 1

You have two different assertions here:

cURL automatically decodes the data when sending it.

...

I've simply dumped the POST data into a file after retrieving it.

It is PHP that automatically DECODES the data when receiving it. It is NOT getting decoded upon sending it!

This integrates with the behaviour of other values, like cookie data, post and get variables, header information like referrer, ... everything get's decoded automatically when it is received, because it is expected to be sent encoded.

When you want to see the exact data that is getting send over the wires, use a tool like ngrep on port 80 to sniff the TCP HTTP traffic.