php://input <> $_POST?

Question

I\'m experimenting with Firefox\'s Content Security Policy. Basically it\'s a special header for the webpage that tells the browser which resources are valid.

When s

Answer 1

If a request is sent as POST it is not necessarily encoded as normal application/x-www-form-urlencoded or multipart/form-data. Should Firefox send a JSON body, then PHP doesn't know how to decode it.

You have to check $_SERVER["HTTP_CONTENT_TYPE"]. If it contains application/json then you must indeed read php://stdin:

if (stripos($_SERVER["HTTP_CONTENT_TYPE"], "application/json")===0) {
     $_POST = json_decode(file_get_contents("php://input"));
// or something like that

Answer 2

$_POST gives you form variables, which show up in the page like this:

POST /some_path HTTP/1.1

myvar=something&secondvar=somethingelse

But what you're getting isn't a valid query string. It probably looks something like this:

POST /some_path HTTP/1.1

{'this':'is a JSON object','notice':'it\'s not a valid query string'}

php://input gives you everything after the headers in raw form, so in this case I think it's the only way to get what you want.

Answer 3

It can be several of other http request types (I am aware of 7 right now, and several place holders for more to come).
I would print the $_REQUEST and $_SERVER to see how it actually arrives.