PHP as interpreted CGI script - necessary variables not set!

PHP programming forum. Ask questions or help people concerning PHP code. Don't understand a function? Need help implementing a class? Don't understand a class? Here is where to ask. Remember to do your homework!

Moderator: General Moderators

Locked
Mark001
Forum Newbie
Posts: 10
Joined: Sat Mar 15, 2008 11:41 pm

PHP as interpreted CGI script - necessary variables not set!

Post by Mark001 »

Hello,

I am on an Apache server that runs all CGI files that have a .cgi extension as SETUID, which means they run as my username. I am in a public_html directory. The sysadmin told me how to run my PHP scripts as my own username by changing the .php extension to .cgi and putting in a SheBang line at the beginning. The SheBang line specifies the PHP binary as the script interpreter, and in addition a line specifying the MIME type is needed. Therefore, any script like:

phpscript001.php:

Code: Select all

<html>
<head></head>
<body>
<?php echo "Hello!"; ?>
</body>
</html>
Becomes a script like:

phpscript001.cgi:

Code: Select all

#!/usr/bin/php
Content-type: text/html
 
<html>
<head></head>
<body>
<?php echo "Hello!"; ?>
</body>
</html>
The advantages to running a PHP script like this are that, since it runs as SETUID, I only need to give the file execute permission (for the apache server and, by extension, other system users) instead of the read permission like for PHP scripts, and I can thus protect the visibility of all my code, including sensitive MySQL database passwords, since the script executes as my own username. SETUID, however, isn't possible with normal PHP scripts with a .php extension (at least on this server -- I think there might be some unconventional ways to do it that are out of reason in this situation).

Now here is the major problem that I found with PHP scripts run as .cgi files: the special PHP variables are not set for them! The variables $_POST, $_GET, $_COOKIE, and $_REQUEST are not set at all like they are for a normal PHP script, and since my code depends on these variables, it dies. It must be because generic CGI executables/scripts aren't run via the standard PHP module under Apache. The script does, however, get passed the generic CGI environment variables, like the query string, post information, etc. They would just have to be parsed manually, which can be unsafe and takes a lot of unnecessary work to make it robust.

Can anyone tell me if I would really need to reinvent the wheel on these PHP variables and parse them myself? Isn't there any way I could just explicitly call the PHP module, library, or header that would do this for me so I can effectively get it to run like a normal PHP script? Maybe there is a special way to call the PHP binary, or some standard API library in include files?

Please note that this post is based on viewtopic.php?f=34&t=80287&p=449753#p449753; it's just that I'm not getting any responses there because I guess I loaded the question too much. Here I'm just isolating the issue of how to fix the PHP variable problem that occurs when I run PHP as an external interpreter.

Thanks
User avatar
John Cartwright
Site Admin
Posts: 11470
Joined: Tue Dec 23, 2003 2:10 am
Location: Toronto
Contact:

Re: PHP as interpreted CGI script - necessary variables not set!

Post by John Cartwright »

1 thread per topic please. I'm locking this thread, let me know if you would like the other one locked instead.
Locked