What does {$value} means inside of a curl post request?

Question

I have the following curl post request

   $Curl_Session = curl_init($url);
        curl_setopt($Curl_Session, CURLOPT_POST, count($post));
        curl_setopt($Curl_Session, CURLOPT_POSTFIELDS, "login={$username}&password={$password}");
        curl_setopt($Curl_Session, CURLOPT_HTTPHEADER, $headers);
        curl_setopt($Curl_Session, CURLOPT_RETURNTRANSFER, 1);
        curl_setopt($Curl_Session, CURLOPT_FOLLOWLOCATION, 1);
        curl_setopt($Curl_Session, CURLOPT_SSL_VERIFYHOST, false );
        curl_setopt($Curl_Session, CURLOPT_SSL_VERIFYPEER, false );     
        $request = curl_exec($Curl_Session);

what does the use of {} means? Can this request be vulnerable to xss ( i mean the login and password parameters)?

It's a curl request with the type set to application/json

check this https://stackoverflow.com/questions/2596837/curly-braces-in-string-in-php — Agam Banga, Jun 05 '17 at 13:04
Possible duplicate of [Curly braces in string in PHP](https://stackoverflow.com/questions/2596837/curly-braces-in-string-in-php) — castis, Jun 05 '17 at 13:05
Means there will be used the value of the variable that is inside {}. Read more about: https://stackoverflow.com/questions/2596837/curly-braces-in-string-in-php — BDS, Jun 05 '17 at 13:05

score 0 · Answer 1 · edited Jun 20 '20 at 09:12

http://php.net/manual/en/language.types.string.php

Complex (curly) syntax

This isn't called complex because the syntax is complex, but because it allows for the use of complex expressions.

Any scalar variable, array element or object property with a string representation can be included via this syntax. Simply write the expression the same way as it would appear outside the string, and then wrap it in { and }. Since { can not be escaped, this syntax will only be recognised when the $ immediately follows the {.

Yes, the way you're using it is vulnerable to injection. You're better passing an array of POST fields, like this:

curl_setopt($Curl_Session, CURLOPT_POSTFIELDS, ['login' => $username, 'password' => $password];

Thanks to everyone for your replies and sorry if it's a duplicated questions.. So it's possible that a request like my example could be vulnerable to sql injection or xss issues? — Ponz Teshyo, Jun 05 '17 at 13:31

What does {$value} means inside of a curl post request?

1 Answers1