What's the difference between POST and raw POST in PHP at all?

Question

I have this question after reading the answer here, what's the difference at all?

Is it possible to submit raw POST with html ?

Solution 1

We can divide form submissions in three cases:

1. Submissions with content type application/x-www-form-urlencoded
2. Submissions with content type multipart/form-data
3. Other submissions.

In cases 1 and 3, $HTTP_RAW_POST_DATA contains the raw post data (except if the option is always_populate_raw_post_data is set to false, in which case $HTTP_RAW_POST_DATA is empty in case 1), i.e., the data exactly as the client (usually the browser) has sent it. In case, 1, the data has a form such as

key1=value1&key2=value2&key3[]=value3.1&key3[]=value3.2

PHP automatically parses this, so that $_POST becomes:

$_POST = array(
    "key1" => "value1",
    "key2" => "value2",
    "key3" => array("value3.1", "value3.2");
)

The contents of the raw data can also be access through php://input, even in case 1 when always_populate_raw_post_data is set to false. In particular, file_get_contents("php://input") gives the same data $HTTP_RAW_POST_DATA has or would have.

In case 3, in which the POST data is arbitrary, $_POST will be an empty array and $HTTP_RAW_POST_DATA will always be populated.

Case 2 is a special one. In that case, PHP will parse the data and $_POST will get the content of the fields which are not uploaded files, but php://input and $HTTP_RAW_POST_DATA will be unavailable.

Solution 2

$HTTP_RAW_POST_DATA will contain something like:

beans=cheese&spam=eggs&one=two

PHP splits this up for you, and shoves it in the $_POST array. Naively, it does something like this:

$parts = explode('&', $HTTP_RAW_POST_DATA);
foreach ( $parts as $part ) {
    list($key, $value) = explode('=', $part, 2);
    $_POST[$key] = $value;
}

Using JavaScript, which can be embedded into HTML, you can POST anything you like with AJAX. Something like this:

var req = new XMLHttpRequest();
req.open('POST', 'http://www.example.com/my_url' true);
req.send('any data you want');

will allow you to POST arbitrary things to the web server.

Comments

[Zash]

Your example code should do urldecode() on $key and $value. This assumes <form enctype> is application/x-www-form-urlencoded, which is the default for most HTML forms. There is also the multipart/form-data which is used for file uploads.

[tomit]

I left out some details for clarity, hence me saying "naively".

[Artefacto]

$_POST also contains the parsed data when the content type is multipart/form-data, in which case php://input cannot be used (same for HTTP_RAW_POST_DATA)

[Frug]

This explanation helped me understand what was going on when jquery calls $.ajax and passes json data to another page.

[brandwaffle]

As a side note, this applies to things beyond form submissions. I came here looking for an explanation of why I had to parse POST requests from AWS SNS notifications using php://input instead of $_POST and this explained it perfectly.