PHP: How to make curl with system()/exec() work always?

Question

The PHP version on our web servers is old and doesn't support TLSv1.2 in curl calls. So I am trying to make a curl call with system()/exec().

This works sometimes but otherwise not.

There is no error when it fails. Then referring to this suggestion - https://stackoverflow.com/a/539030/1278063 I added 2>&1 to the end of command to redirect errors from stderr to stdout. Below is the sample code-

<?php
    $cmd = sprintf('curl -X POST %s --tlsv1.2 2>&1', escapeshellarg($url));
    $sysout = exec($cmd,$output,$ret);
    print_r($output);
?>

The output when the code fails is as follows-

Array ( 
    [0] => mkdir: cannot create directory `/usr/bin/.libs': Permission denied 
    [1] => /usr/bin/curl: line 202: cd: /root/curl-7.57.0/src: Not a directory 
    [2] => gcc: curl-slist_wc.o: No such file or directory 
    [3] => gcc: curl-tool_binmode.o: No such file or directory 
    [4] => gcc: curl-tool_bname.o: No such file or directory 
    [5] => gcc: curl-tool_cb_dbg.o: No such file or directory 
    [6] => gcc: curl-tool_cb_hdr.o: No such file or directory 
    [7] => gcc: curl-tool_cb_prg.o: No such file or directory 
    [8] => gcc: curl-tool_cb_rea.o: No such file or directory 
    [9] => gcc: curl-tool_cb_see.o: No such file or directory 
    [10] => gcc: curl-tool_cb_wrt.o: No such file or directory 
    [11] => gcc: curl-tool_cfgable.o: No such file or directory 
    [12] => gcc: curl-tool_convert.o: No such file or directory 
    [13] => gcc: curl-tool_dirhie.o: No such file or directory 
    [14] => gcc: curl-tool_doswin.o: No such file or directory 
    [15] => gcc: curl-tool_easysrc.o: No such file or directory 
    [16] => gcc: curl-tool_formparse.o: No such file or directory 
    [17] => gcc: curl-tool_getparam.o: No such file or directory 
    [18] => gcc: curl-tool_getpass.o: No such file or directory 
    [19] => gcc: curl-tool_help.o: No such file or directory 
    [20] => gcc: curl-tool_helpers.o: No such file or directory 
    [21] => gcc: curl-tool_homedir.o: No such file or directory 
    [22] => gcc: curl-tool_hugehelp.o: No such file or directory 
    [23] => gcc: curl-tool_libinfo.o: No such file or directory 
    [24] => gcc: curl-tool_main.o: No such file or directory 
    [25] => gcc: curl-tool_metalink.o: No such file or directory 
    [26] => gcc: curl-tool_msgs.o: No such file or directory 
    [27] => gcc: curl-tool_operate.o: No such file or directory 
    [28] => gcc: curl-tool_operhlp.o: No such file or directory 
    [29] => gcc: curl-tool_panykey.o: No such file or directory 
    [30] => gcc: curl-tool_paramhlp.o: No such file or directory 
    [31] => gcc: curl-tool_parsecfg.o: No such file or directory 
    [32] => gcc: curl-tool_strdup.o: No such file or directory 
    [33] => gcc: curl-tool_setopt.o: No such file or directory 
    [34] => gcc: curl-tool_sleep.o: No such file or directory 
    [35] => gcc: curl-tool_urlglob.o: No such file or directory 
    [36] => gcc: curl-tool_util.o: No such file or directory 
    [37] => gcc: curl-tool_vms.o: No such file or directory 
    [38] => gcc: curl-tool_writeout.o: No such file or directory 
    [39] => gcc: curl-tool_xattr.o: No such file or directory 
    [40] => gcc: ../lib/curl-strtoofft.o: No such file or directory 
    [41] => gcc: ../lib/curl-nonblock.o: No such file or directory 
    [42] => gcc: ../lib/curl-warnless.o: No such file or directory 
    [43] => gcc: ../lib/.libs/libcurl.so: No such file or directory 
)

Why does the code work sometimes? How to make it working always?

If your PHP doesn't support TLS 1.2, then you're likely running a version that has not had any recent security updates and is therefore open for exploitation. — Devon Bessemer, Jan 05 '18 at 12:27

score 0 · Answer 1 · answered Jan 09 '18 at 13:22

compile a static curl library on an up-to-date system (should be ./configure --disable-shared --with-ssl) and copy the static curl library to your old system, now TLS should work fine. but because, from personal experience, static compiles sometimes fail for various reasons, SILENTLY (at least with gcc), you should verify that it is static, eg ldd ./curl (it will complain about curl being static if it is static, or print a list of libs it tries to load otherwise.)

PHP: How to make curl with system()/exec() work always?

1 Answers1