Shell script equivelent to PHP $_POST
Multi tool use
For example and learning purposes, I have a webpage that uses POST method to submit a text field. I have a server running script (bash) that I want to display what the "Query_string" is. I'm not completely familiar with PHP either, but I think $_POST would be used to print the submitted text. The script I am using is bash. What could I use to print out the submitted text?
bash shell-script html
edited Nov 6 '14 at 5:37
Anthon
61.4k17107170
asked Nov 6 '14 at 4:43
swamswam
537
add a comment |
For example and learning purposes, I have a webpage that uses POST method to submit a text field. I have a server running script (bash) that I want to display what the "Query_string" is. I'm not completely familiar with PHP either, but I think $_POST would be used to print the submitted text. The script I am using is bash. What could I use to print out the submitted text?
bash shell-script html
edited Nov 6 '14 at 5:37
Anthon
61.4k17107170
asked Nov 6 '14 at 4:43
swamswam
537
2
See the CGI specification; there are environment variables defined in section 5 includingQUERY_STRING. Post data will be on standard input. That said, a) I think this may be more of a general programming or protocol question that is off-topic here, and b) conflating the query string and post data probably isn't the best sign for how well you're going to go with this. In particular, please note that it's very easy to write severe security holes in Bash CGI scripts.
– Michael Homer
Nov 6 '14 at 5:04
1
Make sure you have upgradedbashto a recent version if this machine is accessible via a network (schellshock)
– Anthon
Nov 6 '14 at 5:39
add a comment |
For example and learning purposes, I have a webpage that uses POST method to submit a text field. I have a server running script (bash) that I want to display what the "Query_string" is. I'm not completely familiar with PHP either, but I think $_POST would be used to print the submitted text. The script I am using is bash. What could I use to print out the submitted text?
bash shell-script html
edited Nov 6 '14 at 5:37
Anthon
61.4k17107170
asked Nov 6 '14 at 4:43
swamswam
537
For example and learning purposes, I have a webpage that uses POST method to submit a text field. I have a server running script (bash) that I want to display what the "Query_string" is. I'm not completely familiar with PHP either, but I think $_POST would be used to print the submitted text. The script I am using is bash. What could I use to print out the submitted text?
bash shell-script html
bash shell-script html
edited Nov 6 '14 at 5:37
Anthon
61.4k17107170
asked Nov 6 '14 at 4:43
swamswam
537
edited Nov 6 '14 at 5:37
Anthon
61.4k17107170
asked Nov 6 '14 at 4:43
swamswam
537
edited Nov 6 '14 at 5:37
Anthon
61.4k17107170
edited Nov 6 '14 at 5:37
Anthon
61.4k17107170
edited Nov 6 '14 at 5:37
Anthon
61.4k17107170
61.4k17107170
asked Nov 6 '14 at 4:43
swamswam
537
asked Nov 6 '14 at 4:43
swamswam
537
asked Nov 6 '14 at 4:43
swamswam
537
537
2
See the CGI specification; there are environment variables defined in section 5 includingQUERY_STRING. Post data will be on standard input. That said, a) I think this may be more of a general programming or protocol question that is off-topic here, and b) conflating the query string and post data probably isn't the best sign for how well you're going to go with this. In particular, please note that it's very easy to write severe security holes in Bash CGI scripts.
– Michael Homer
Nov 6 '14 at 5:04
1
Make sure you have upgradedbashto a recent version if this machine is accessible via a network (schellshock)
– Anthon
Nov 6 '14 at 5:39
add a comment |
2
See the CGI specification; there are environment variables defined in section 5 includingQUERY_STRING. Post data will be on standard input. That said, a) I think this may be more of a general programming or protocol question that is off-topic here, and b) conflating the query string and post data probably isn't the best sign for how well you're going to go with this. In particular, please note that it's very easy to write severe security holes in Bash CGI scripts.
– Michael Homer
Nov 6 '14 at 5:04
1
Make sure you have upgradedbashto a recent version if this machine is accessible via a network (schellshock)
– Anthon
Nov 6 '14 at 5:39
2
2
See the CGI specification; there are environment variables defined in section 5 including
QUERY_STRING. Post data will be on standard input. That said, a) I think this may be more of a general programming or protocol question that is off-topic here, and b) conflating the query string and post data probably isn't the best sign for how well you're going to go with this. In particular, please note that it's very easy to write severe security holes in Bash CGI scripts.– Michael Homer
Nov 6 '14 at 5:04
See the CGI specification; there are environment variables defined in section 5 including
QUERY_STRING. Post data will be on standard input. That said, a) I think this may be more of a general programming or protocol question that is off-topic here, and b) conflating the query string and post data probably isn't the best sign for how well you're going to go with this. In particular, please note that it's very easy to write severe security holes in Bash CGI scripts.– Michael Homer
Nov 6 '14 at 5:04
1
1
Make sure you have upgraded
bash to a recent version if this machine is accessible via a network (schellshock)– Anthon
Nov 6 '14 at 5:39
Make sure you have upgraded
bash to a recent version if this machine is accessible via a network (schellshock)– Anthon
Nov 6 '14 at 5:39
add a comment |
1 Answer
1
active
oldest
votes
As noted by the first comment, the CGI spec says that the POST data will be on standard input, encoded with the enctype specified by the form. However all methods should be supported: multipart/form-data, application/x-www-form-urlencoded, and HTML5's text/plain
Here's a really quick test script you can play with:
#!/bin/sh
echo Content-type: text/plain
echo
echo Environment
printenv
echo POST contents
cat
The CONTENT_TYPE variable will be set to the method used for the data.
If it's application/x-www-form-urlencoded, then you're going to see the classic key=value&key=value syntax, and you have to remember to URL-unescape it.
If it's multipart/form-data, then it's MIME, and you should watch out, there have been exploits against MIME parsers before.
If it's the new HTML5 text/plain, then just take the entire input from stdin as-is. This method is meant for file uploads, not form submission; you can feed the stdin file descriptor to another process safely, without having to decode URLs or MIME.
And I'd like to echo the warnings of the others here. If you aren't patched against shellshock, just letting an attacker run the CGI can be enough to exploit your system (all they have to do is override all your common shell commands, and they are bound to find one you use).
answered Nov 6 '14 at 6:01
robbat2robbat2
2,5011027
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "106"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f166311%2fshell-script-equivelent-to-php-post%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
As noted by the first comment, the CGI spec says that the POST data will be on standard input, encoded with the enctype specified by the form. However all methods should be supported: multipart/form-data, application/x-www-form-urlencoded, and HTML5's text/plain
Here's a really quick test script you can play with:
#!/bin/sh
echo Content-type: text/plain
echo
echo Environment
printenv
echo POST contents
cat
The CONTENT_TYPE variable will be set to the method used for the data.
If it's application/x-www-form-urlencoded, then you're going to see the classic key=value&key=value syntax, and you have to remember to URL-unescape it.
If it's multipart/form-data, then it's MIME, and you should watch out, there have been exploits against MIME parsers before.
If it's the new HTML5 text/plain, then just take the entire input from stdin as-is. This method is meant for file uploads, not form submission; you can feed the stdin file descriptor to another process safely, without having to decode URLs or MIME.
And I'd like to echo the warnings of the others here. If you aren't patched against shellshock, just letting an attacker run the CGI can be enough to exploit your system (all they have to do is override all your common shell commands, and they are bound to find one you use).
answered Nov 6 '14 at 6:01
robbat2robbat2
2,5011027
add a comment |
As noted by the first comment, the CGI spec says that the POST data will be on standard input, encoded with the enctype specified by the form. However all methods should be supported: multipart/form-data, application/x-www-form-urlencoded, and HTML5's text/plain
Here's a really quick test script you can play with:
#!/bin/sh
echo Content-type: text/plain
echo
echo Environment
printenv
echo POST contents
cat
The CONTENT_TYPE variable will be set to the method used for the data.
If it's application/x-www-form-urlencoded, then you're going to see the classic key=value&key=value syntax, and you have to remember to URL-unescape it.
If it's multipart/form-data, then it's MIME, and you should watch out, there have been exploits against MIME parsers before.
If it's the new HTML5 text/plain, then just take the entire input from stdin as-is. This method is meant for file uploads, not form submission; you can feed the stdin file descriptor to another process safely, without having to decode URLs or MIME.
And I'd like to echo the warnings of the others here. If you aren't patched against shellshock, just letting an attacker run the CGI can be enough to exploit your system (all they have to do is override all your common shell commands, and they are bound to find one you use).
answered Nov 6 '14 at 6:01
robbat2robbat2
2,5011027
add a comment |
As noted by the first comment, the CGI spec says that the POST data will be on standard input, encoded with the enctype specified by the form. However all methods should be supported: multipart/form-data, application/x-www-form-urlencoded, and HTML5's text/plain
Here's a really quick test script you can play with:
#!/bin/sh
echo Content-type: text/plain
echo
echo Environment
printenv
echo POST contents
cat
The CONTENT_TYPE variable will be set to the method used for the data.
If it's application/x-www-form-urlencoded, then you're going to see the classic key=value&key=value syntax, and you have to remember to URL-unescape it.
If it's multipart/form-data, then it's MIME, and you should watch out, there have been exploits against MIME parsers before.
If it's the new HTML5 text/plain, then just take the entire input from stdin as-is. This method is meant for file uploads, not form submission; you can feed the stdin file descriptor to another process safely, without having to decode URLs or MIME.
And I'd like to echo the warnings of the others here. If you aren't patched against shellshock, just letting an attacker run the CGI can be enough to exploit your system (all they have to do is override all your common shell commands, and they are bound to find one you use).
answered Nov 6 '14 at 6:01
robbat2robbat2
2,5011027
As noted by the first comment, the CGI spec says that the POST data will be on standard input, encoded with the enctype specified by the form. However all methods should be supported: multipart/form-data, application/x-www-form-urlencoded, and HTML5's text/plain
Here's a really quick test script you can play with:
#!/bin/sh
echo Content-type: text/plain
echo
echo Environment
printenv
echo POST contents
cat
The CONTENT_TYPE variable will be set to the method used for the data.
If it's application/x-www-form-urlencoded, then you're going to see the classic key=value&key=value syntax, and you have to remember to URL-unescape it.
If it's multipart/form-data, then it's MIME, and you should watch out, there have been exploits against MIME parsers before.
If it's the new HTML5 text/plain, then just take the entire input from stdin as-is. This method is meant for file uploads, not form submission; you can feed the stdin file descriptor to another process safely, without having to decode URLs or MIME.
And I'd like to echo the warnings of the others here. If you aren't patched against shellshock, just letting an attacker run the CGI can be enough to exploit your system (all they have to do is override all your common shell commands, and they are bound to find one you use).
answered Nov 6 '14 at 6:01
robbat2robbat2
2,5011027
answered Nov 6 '14 at 6:01
robbat2robbat2
2,5011027
answered Nov 6 '14 at 6:01
robbat2robbat2
2,5011027
answered Nov 6 '14 at 6:01
robbat2robbat2
2,5011027
2,5011027
add a comment |
add a comment |
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f166311%2fshell-script-equivelent-to-php-post%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
IyB5uXP8pMGwD,GMMymgQBB
2
See the CGI specification; there are environment variables defined in section 5 including
QUERY_STRING. Post data will be on standard input. That said, a) I think this may be more of a general programming or protocol question that is off-topic here, and b) conflating the query string and post data probably isn't the best sign for how well you're going to go with this. In particular, please note that it's very easy to write severe security holes in Bash CGI scripts.– Michael Homer
Nov 6 '14 at 5:04
1
Make sure you have upgraded
bashto a recent version if this machine is accessible via a network (schellshock)– Anthon
Nov 6 '14 at 5:39