PHP cURL vs file_get_contents

php curl file-get-contents

116,043

Solution 1

file_get_contents() is a simple screwdriver. Great for simple GET requests where the header, HTTP request method, timeout, cookiejar, redirects, and other important things do not matter.

fopen() with a stream context or cURL with setopt are powerdrills with every bit and option you can think of.

Solution 2

In addition to this, due to some recent website hacks we had to secure our sites more. In doing so, we discovered that file_get_contents failed to work, where curl still would work.

Not 100%, but I believe that this php.ini setting may have been blocking the file_get_contents request.

; Disable allow_url_fopen for security reasons
allow_url_fopen = 0

Either way, our code now works with curl.

Solution 3

This is old topic but on my last test on one my API, cURL is faster and more stable. Sometimes file_get_contents on larger request need over 5 seconds when cURL need only from 1.4 to 1.9 seconds what is double faster.

I need to add one note on this that I just send GET and recive JSON content. If you setup cURL properly, you will have a great response. Just "tell" to cURL what you need to send and what you need to recive and that's it.

On your exampe I would like to do this setup:

$ch =  curl_init('http://api.bitly.com/v3/shorten?login=user&apiKey=key&longUrl=url');
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
    curl_setopt($ch, CURLOPT_HTTPAUTH, CURLAUTH_BASIC);
    curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 5);
    curl_setopt($ch, CURLOPT_TIMEOUT, 3);
    curl_setopt($ch, CURLOPT_HTTPHEADER, array('Accept: application/json'));
$result = curl_exec($ch);

This request will return data in 0.10 second max

116,043

Salvador Dali

I am a Software Engineer in the Google Search Growth team. I use Tensorflow and TFX to analyze search data and Go to write data pipelines. This is my personal profile which has absolutely nothing to do with my employer.

Updated on August 22, 2020

Comments

Salvador Dali almost 4 years
How do these two pieces of code differ when accessing a REST API?
```
$result = file_get_contents('http://api.bitly.com/v3/shorten?login=user&apiKey=key&longUrl=url');
```
and
```
$ch = curl_init('http://api.bitly.com/v3/shorten?login=user&apiKey=key&longUrl=url');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$result = curl_exec($ch);
```
They both produce the same result, judging by
```
print_r(json_decode($result))
```
- Admin almost 12 years
  
  cURL is capable of much more than file_get_contents. That should be enough.
- David Gilbertson almost 11 years
  
  FWIW there's little difference with regards to speed. I've just finished fetching 5,000 URLs and saving their HTML to files (about 200k per file). I did half with curl and half with file_get_contents as an experiment and there was no discernible difference.
- Chris Strickland over 9 years
  
  It is possible to send post data with file_get_contents, as long as you are using a version that supports stream context.
poke almost 12 years

To stay within that metaphor, note that cURL is a powerdrill with a complicated drill chuck that requires you to know it pretty well to actually change it (read: setting cURL options is a bit tedious, but allows for doing anything you want).
velop over 10 years

file_get_contents allows also to set the context, which means you can set the header fields as you like.
Costa over 10 years

Yes, file_get_contents requires allow_url_fopen to be truthy.
frustratedtech over 10 years

Yes, many hosting companies are disabling file_get_contents() due to many exploits that are known to use the function. cURL is the function people should be using in code now.
rdlowrey about 10 years

@frustratedtech What "exploits" are these?
fritzmg about 9 years

Hosting companies disable allow_url_fopen because they kind of mistake it for allow_url_include. allow_url_fopen and file_get_contents are fine to use.
vr_driver almost 9 years

@rdlowrey, curl.haxx.se/docs/vulnerabilities.html blog.cloudflare.com/inside-shellshock
rdlowrey almost 9 years

@vr_driver those links have nothing to do with file_get_contents()
Markus Köhler almost 9 years

and as addition to @velop's comment, through the stream context it is also possible to send POST, PUT, authentication, headers, content, proxy, and much more with one file_get_contents request
Mark Tomlin over 7 years

0.1 MICROseconds (1/1,000 of a MILIseconds) ... I find that hard to believe.
Ivijan Stefan Stipić over 7 years

Yes. I have some responses in 0.02ms for example Twilio API phone number check. Is fast.
Walf over 7 years

0.02ms = 20 microseconds; you said 0.1 microseconds which can't be right.
Sz. about 6 years

@velop: Yes. And method, too. And redirects. And timeout... php.net/manual/en/context.http.php
Jsp almost 6 years

This is almost twice as fast compare to file_get_contents I just did some API calls to confirm. 0.8 seconds for file_get_contents & 0.49 seconds for curl (3 API calls)
Rauli Rajande over 5 years

You should use your own setup. Then your queries would go from 1.4-1.9s to 0.01s ;)
jdhildeb almost 5 years

Yes, hosting companies disable allow_url_fopen because of exploits. The typical use case of file_get_contents is to read a local file. But if you can find a way to override the filename and pass a URL instead, then you can read a REMOTE file instead (and it could be a file whose contents you control...) I understand the need to keep this box locked shut. file_get_contents should not have been given this magical power in the first place - it should have been a separate function.
verbumSapienti almost 5 years

@jdhildeb it is not a "magical power", nor an obscure use case, as evidenced by "Example #1 Get and output the source of the homepage of a website", it is simply a wrapper for fopen(). if you can find a way to override the filename and pass a URL instead, you are either ignoring or in dire need of basic security practice