php curl multipart/data-form content-type for each boundary

Question

I guess I'd like to know if it is possible POST multipart/data-form content type containing json, files, txt, xml in the same post. so request would look like this:

Content-Type: multipart/form-data; boundary=BOUNDARY
--BOUNDARY
Content-type:application/json
Content-Disposition:form-data

{{"SomeJsonObject":"valueOfObject"}}
--BOUNDARY
Content-type:application/xml
Content-Disposition:form-data

<node>SomeXML Nodes</node>
--BOUNDARY--

I know I can code this as a string, include boundaries manually, but I want to know if it is possible via

curl_setopt($curl, CURLOPT_POSTFIELDS, $data);

Thank you

Answer 1

there is no way to post STRING data in POST except building boundary yourself but curl can post files from disk so

file_put_contents('/tmp/fileForSend.json');
curl_setopt($curl, CURLOPT_POSTFIELDS, array(
  'file' =? '@/tmp/fileForSend.json;type=application/json', // this is CURL integrared feature, curl will read file itself
));

so putting '@' sybmol means for CURL that it must read file and put its content into POST request

Answer 2

You can pass Content-Type to each multipart boundary with this hack also:

$url = 'https://...'
$data = ["json\";\nContent-type:\"application/json\";\nContent-disposition:\"form-data" => '{"my":json}',
         "xml\";\nContent-type:\"application/xml\";\nContent-disposition:\"form-data" => "<root/>"];

$resource = curl_init();
curl_setopt($resource, CURLOPT_URL, $url);
curl_setopt($resource, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($resource, CURLOPT_POSTFIELDS, $data);
$result = curl_exec($resource);
curl_close($resource);

The idea is to 'inject' all necessary headers to "name" option, like in SQL injection.

The code above will send multipart request with all necessary headers:

------------------------------b66e31048210
Content-Disposition: form-data; name="json";
Content-type:"application/json";
Content-disposition:"form-data"

{"my":json}
------------------------------b66e31048210
Content-Disposition: form-data; name="xml";
Content-type:"application/xml";
Content-disposition:"form-data"

<root/>

But be careful, this stuff is very bad documented.