如何确保我的PHP脚本仅作为计划作业而不是从浏览器运行？

Question

Each time when I am opening eg retrieveContent.php the script is executed and insert records into the database. Since I use this script in a schedule job it should not be a problem.

However I noticed that a user found the script path and did opened the retrieveContent.php file which was executed and inserted a record in the database. How can I prevent browser transactions by a user using PHP? Thanks in advance!

Answer 1

Look at the php_sapi_name() function. It will tell you if you're running in CLI (command-line interface).

http://php.net/manual/en/function.php-sapi-name.php

You can also move the PHP script to somewhere outside of your web server's document tree.

Answer 2

You have lots of options. I'll mention just three:

1. Append a query parameter, that only you know and that is hard-coded in the script, eg retrieveContent.php?key=secret . (Or in CLI mode, a secret command line argument.) Check this parameter in your script and only perform the actions if it matches the hard-coded value.

2. If your scheduled job is performed on the same server where the script resides, move the script to a separate directory protected by a .htaccess file with the following content:

    Deny from all Allow from localhost 

3. If your scheduled job fetches the script via HTTP, figure out, which user agent is sent in $_SERVER['HTTP_USER_AGENT'] , and only perform the actions if the script is accessed by that user agent. But this is less safe, since the user can fake the user agent (if he manages to find out the correct one).

Answer 3

Pass a secret argument to your script when called via CLI and confirm it on PHP side. For example:

-- terminal --
php script.php secret-argument

-- script.php --
<?php
if(!isset($argv[1]) || $argv[1] != 'secret-argument')
{
   die('restricted access');
}

// Rest of script

$argv is a global PHP variable that Contains an array of all the arguments passed to the script when running from the command line.

Answer 4

Couple of ways this could be done:

1. if(php_sapi_name() != 'cli'){ die();} or if(PHP_SAPI != 'cli'){ die();}

The following solutions won't always work depending on server settings:

1. Check for $_SERVER['argv'], it is only set on CLI execution if (empty($_SERVER['argv'])) { die();} . This is mostly true, unless your server loads those on HTTP request.

2. if(!empty($_SERVER['REMOTE_ADDR'])) { die();} REMOTE_ADDR is empty when called via CLI.

3. if(empty($_SERVER['TERM'])) { die();} PHP loads the TERM variable with the terminal type. Same is true for $_SERVER['SHELL'] or $_SERVER['USER'] .