How to extract a gzip POST request in PHP sent through Python

Question

I am trying to populate a database with results obtained by my python script. I am sending the gzipped data in POST request.

A PHP script acts in the middle as web services and needs to extract the gzip data and get 'sql-query' and do the further process.

This is what I am trying to do on Python side :

Sending a POST request using urllib:

# Data to be sent in POST request, it can be a SQL UPDATE/INSERT or SELECT
dictheaders = {'sql': "UPDATE 'logs' SET 'some_value' = Failed"}

# Encode the data
data = urllib.urlencode(dictheaders)

# Gzip compress the encoded data
IO = StringIO.StringIO()
gzip_data = gzip.GzipFile(fileobj=IO, mode='w')
gzip_data.write(data)
gzip_data.close()
gzip_data = IO.getvalue()

# This is the POST request being sent to a PHP web services file which
# needs to extract the gzipped query and then execute the query on SQL
f = urllib2.urlopen('http://x.x.x.x/example.php', gzip_data)

Following are the changes I have tried on PHP side:

$postdata = file_get_contents("php://input");
$a = gzinflate(substr(substr($postdata, 10), 0, -8));
$sql = $a['sql'];

The above code does not seem to be compatible with my Python code. Is this the right way to extract the gzip POST request in PHP ?

Most web server handle the compressing themselves. On the Python side: http://stackoverflow.com/a/3947241/539465 — Valentin Lorentz, May 15 '14 at 17:18
Do you realize you're trying to send `set` object as headers (`dictheaders = {'sql', 'SELECT * FROM employees'}` is a `set`)? — vaultah, May 15 '14 at 17:19

score 3 · Accepted Answer · answered May 15 '14 at 17:32

3

You used gzip.GzipFile, which writes a gzip file header that you need to strip off the data before passing it into gzinflate; then, by the look of your code, you probably want to do something like parse_str on it:

$str = gzinflate(substr($postdata, 10, -8));
parse_str($str, $a);
echo $a['sql'];

Also, in your python code, there's either a typo or a fundamental error on this line:

dictheaders = {'sql', 'SELECT * FROM employees'}

Try this instead:

dictheaders = {'sql': 'SELECT * FROM employees'}

answered May 15 '14 at 17:32

TML

12,813
3
38
45

That missing ':' was a typo, BTW changes suggested by you worked for me. Thanks. – user1945383 May 19 '14 at 18:39
You should look at Ryan P.'s answer as well - you'd be much better off never adding the file header in the first place. – TML May 20 '14 at 01:40
1

Yes Obviously, I have looked at Ryan's suggestion as well. I have tried that and seems to work fine. – user1945383 May 22 '14 at 16:14

score 1 · Answer 2 · answered May 15 '14 at 17:49

Try replacing this:

# Gzip compress the encoded data
IO = StringIO.StringIO()
gzip_data = gzip.GzipFile(fileobj=IO, mode='w')
gzip_data.write(data)
gzip_data.close()
gzip_data = IO.getvalue()

with this:

gzip_data = zlib.compress(data)

No need to make a gzip file when all you really want is to compress the data.

The PHP side is good, just remove the substr as they are no longer needed. However - you're treating the uncompressed string as an array, which won't work. You need to decode the query string on the PHP side. I personally just use JSON for this stuff.

How to extract a gzip POST request in PHP sent through Python

2 Answers2