PHP input/output streams

• php://stdin
• php://stdout
• php://stderr
• php://output
• php://input
• php://filter (available since PHP 5.0.0)
• php://memory (available since PHP 5.1.0)
• php://temp (available since PHP 5.1.0)

php://stdin, php://stdout and php://stderr allow access to the corresponding input or output stream of the PHP process. The stream references a duplicate file descriptor, so if you open php://stdin and later close it, you close only your copy of the descriptor--the actual stream referenced by STDIN is unaffected. Note that PHP exhibited buggy behavior in this regard until PHP 5.2.1. It is recommended that you simply use the constants STDIN, STDOUT and STDERR instead of manually opening streams using these wrappers.

php://output allows you to write to the output buffer mechanism in the same way as print() and echo().

php://input allows you to read raw POST data. It is a less memory intensive alternative to $HTTP_RAW_POST_DATA and does not need any special php.ini directives. php://input is not available with enctype="multipart/form-data".

php://stdin and php://input are read-only, whereas php://stdout, php://stderr and php://output are write-only.

php://filter is a kind of meta-wrapper designed to permit the application of filters to a stream at the time of opening. This is useful with all-in-one file functions such as readfile(), file(), and file_get_contents() where there is otherwise no opportunity to apply a filter to the stream prior the contents being read.

The php://filter target takes the following 'parameters' as parts of its 'path'.

• /resource=<stream to be filtered> (required) This parameter must be located at the end of your php://filter specification and should point to the stream which you want filtered.

  <?php
/* This is equivalent to simply:
   readfile("http://www.example.com");
   since no filters are actually specified */

readfile("php://filter/resource=http://www.example.com");
?>

• /read=<filter list to apply to read chain> (optional) This parameter takes one or more filternames separated by the pipe character |.

  <?php
/* This will output the contents of
   www.example.com entirely in uppercase */
readfile("php://filter/read=string.toupper/resource=http://www.example.com");

/* This will do the same as above
   but will also ROT13 encode it */
readfile("php://filter/read=string.toupper|string.rot13/resource=http://www.example.com");
?>

• /write=<filter list to apply to write chain> (optional) This parameter takes one or more filternames separated by the pipe character |.

  <?php
/* This will filter the string "Hello World"
   through the rot13 filter, then write to
   example.txt in the current directory */
file_put_contents("php://filter/write=string.rot13/resource=example.txt","Hello World");
?>

• /<filter list to apply to both chains> (optional) Any filter lists which are not prefixed specifically by read= or write= will be applied to both the read and write chains (as appropriate).

The php://memory wrapper stores the data in the memory. php://temp behaves similarly, but uses a temporary file for storing the data when a certain memory limit is reached (the default is 2 MB).

The php://temp wrapper takes the following 'parameters' as parts of its 'path':

• /maxmemory:<number of bytes> (optional). This parameter allows changing the default value for the memory limit (when the data is moved to a temporary file).

  <?php
$fiveMBs = 5 * 1024 * 1024;
$fp = fopen("php://temp/maxmemory:$fiveMBs", 'r+');

fputs($fp, "hello\n");

// read what we have written
rewind($fp);
echo stream_get_contents($fp);
?>

Wrapper Summary (For php://filter, refer to summary of wrapper being filtered.)

Attribute	Supported
Restricted by allow_url_fopen	No
Restricted by allow_url_include	php://input, php://stdin, php://memory and php://temp only.
Allows Reading	php://stdin, php://input, php://memory and php://temp only.
Allows Writing	php://stdout, php://stderr, php://output, php://memory and php://temp only.
Allows Appending	php://stdout, php://stderr, php://output, php://memory and php://temp only. (Equivalent to writing)
Allows Simultaneous Reading and Writing	php://memory and php://temp only.
Supports stat()	php://memory and php://temp only.
Supports unlink()	No
Supports rename()	No
Supports mkdir()	No
Supports rmdir()	No