note 125146 deleted from function.header by crell

Note Submitter: atesin $ gmail ---- CGI (not FastCGI) is easy to learn and good for small http servers ... i am writing one to learn programming (python)... that lead me to research php-cgi internals . php running in CGI mode works like this: - if we type "php-cgi[.exe]" at console, seems it freezes and nothing happens, but is actually waiting for a valid html/php code from standard input until EOF is reached (*nix: ctrl-d , win: ctrl-z + enter, or an actual piped file or stream) - we can also enter a php file path as first parameter: "php-cgi /my/php/file" - the two behaviors described above are disabled when GATEWAY_INTERFACE env-var is set (commonly with "CGI/1.1") - if php-cgi was compiled with "--enable-force-cgi-redirect" option, it also requires the REDIRECT_STATUS env-var set to "200" (according php and nginx documentation)... - so the current way to provide the file path is setting the SCRIPT_FILENAME env-var ... it also works with PATH_TRANSLATED but discouraged by security reasons . wikipedia and php have good documentation about CGI env-vars: - https://en.wikipedia.org/wiki/Common_Gateway_Interface - https://www.php.net/manual/en/reserved.variables.server.php . PHP CGI PROCESS suppose you pass this file/code to php-cgi -------------------------------- <?php echo mt_rand(1000, 999); ?> -------------------------------- php-cgi standard output will show some like -------------------------------- X-Powered-By: PHP/7.1.0 Content-type: text/html; charset=UTF-8 5806 -------------------------------- note the few included response headers and the lack of status line... seems was made this way to continue previous headers from http server this let me think about header() function, so i make little more tests input -------------------------------- <?php header('Location: http://some.web.page'); ?> -------------------------------- output -------------------------------- Status: 302 Found X-Powered-By: PHP/7.1.0 Location: http://some.web.page Content-type: text/html; charset=UTF-8 -------------------------------- note the new "status code" was not specified through "HTTP/..." status line but instead through a new "Status:" header ... in fact there are 2 new headers, "Status:" and "Location:" according php header() documentation this let me think, in cgi mode php header function don't have the access to actually change response status, maybe the cgi specification never intended ... i don't know what would happen with a response with "HTTP/X.Y 200 OK" and later "Status: 123 Other Status", the server should deal the situation i also realized header() don't have the ability to force replace (via the second paramter) the headers sent by server, at least in cgi mode cheers