For example and learning purposes, I have a webpage that uses POST method to submit a text field. I have a server running script (bash) that I want to display what the "Query_string" is. I'm not completely familiar with PHP either, but I think $_POST would be used to print the submitted text. The script I am using is bash. What could I use to print out the submitted text?

  • 3
    See the CGI specification; there are environment variables defined in section 5 including QUERY_STRING. Post data will be on standard input. That said, a) I think this may be more of a general programming or protocol question that is off-topic here, and b) conflating the query string and post data probably isn't the best sign for how well you're going to go with this. In particular, please note that it's very easy to write severe security holes in Bash CGI scripts. – Michael Homer Nov 6 '14 at 5:04
  • 1
    Make sure you have upgraded bash to a recent version if this machine is accessible via a network (schellshock) – Anthon Nov 6 '14 at 5:39

As noted by the first comment, the CGI spec says that the POST data will be on standard input, encoded with the enctype specified by the form. However all methods should be supported: multipart/form-data, application/x-www-form-urlencoded, and HTML5's text/plain

Here's a really quick test script you can play with:

echo Content-type: text/plain
echo Environment

echo POST contents

The CONTENT_TYPE variable will be set to the method used for the data.

If it's application/x-www-form-urlencoded, then you're going to see the classic key=value&key=value syntax, and you have to remember to URL-unescape it.

If it's multipart/form-data, then it's MIME, and you should watch out, there have been exploits against MIME parsers before.

If it's the new HTML5 text/plain, then just take the entire input from stdin as-is. This method is meant for file uploads, not form submission; you can feed the stdin file descriptor to another process safely, without having to decode URLs or MIME.

And I'd like to echo the warnings of the others here. If you aren't patched against shellshock, just letting an attacker run the CGI can be enough to exploit your system (all they have to do is override all your common shell commands, and they are bound to find one you use).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.