PHP cURL vs file_get_contents

Question

How do these two pieces of code differ when accessing a REST API?

$result = file_get_contents('http://api.bitly.com/v3/shorten?login=user&apiKey=key&longUrl=url');

and

$ch = curl_init('http://api.bitly.com/v3/shorten?login=user&apiKey=key&longUrl=url');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$result = curl_exec($ch);

They both produce the same result, judging by

print_r(json_decode($result))

Soyuz

cURL is capable of much more than file_get_contents. That should be enough. – Commandeer

FWIW there's little difference with regards to speed. I've just finished fetching 5,000 URLs and saving their HTML to files (about 200k per file). I did half with curl and half with file_get_contents as an experiment and there was no discernible difference. – Higgins

It is possible to send post data with file_get_contents, as long as you are using a version that supports stream context. – Reams

I prefer file_get_contents because of its simplicity, but I'm frequently unable to use it if allow_url_fopen is turned off in server configurations that I have no control over. So for that reason alone I recommend cURL with a possible function_exists('curl_init') check and if that doesn't pass a fallback to file_get_contents. – Zeus

Answer 1

file_get_contents() is a simple screwdriver. Great for simple GET requests where the header, HTTP request method, timeout, cookiejar, redirects, and other important things do not matter.

fopen() with a stream context or cURL with setopt are powerdrills with every bit and option you can think of.

Nitrite

To stay within that metaphor, note that cURL is a powerdrill with a complicated drill chuck that requires you to know it pretty well to actually change it (read: setting cURL options is a bit tedious, but allows for doing anything you want). – Quinonez

file_get_contents allows also to set the context, which means you can set the header fields as you like. – Constantia

and as addition to @velop's comment, through the stream context it is also possible to send POST, PUT, authentication, headers, content, proxy, and much more with one file_get_contents request – Pretend

@velop: Yes. And method, too. And redirects. And timeout... php.net/manual/en/context.http.php – Xanthin

Answer 2

In addition to this, due to some recent website hacks we had to secure our sites more. In doing so, we discovered that file_get_contents failed to work, where curl still would work.

Not 100%, but I believe that this php.ini setting may have been blocking the file_get_contents request.

; Disable allow_url_fopen for security reasons
allow_url_fopen = 0

Either way, our code now works with curl.

Lammergeier

Yes, file_get_contents requires allow_url_fopen to be truthy. – Sideboard

Yes, many hosting companies are disabling file_get_contents() due to many exploits that are known to use the function. cURL is the function people should be using in code now. – Fibriform

@Fibriform What "exploits" are these? – Martini

Hosting companies disable allow_url_fopen because they kind of mistake it for allow_url_include. allow_url_fopen and file_get_contents are fine to use. – Gosport

@rdlowrey, curl.haxx.se/docs/vulnerabilities.html blog.cloudflare.com/inside-shellshock – Lammergeier

@Lammergeier those links have nothing to do with file_get_contents() – Martini

Yes, hosting companies disable allow_url_fopen because of exploits. The typical use case of file_get_contents is to read a local file. But if you can find a way to override the filename and pass a URL instead, then you can read a REMOTE file instead (and it could be a file whose contents you control...) I understand the need to keep this box locked shut. file_get_contents should not have been given this magical power in the first place - it should have been a separate function. – Germen

@Germen it is not a "magical power", nor an obscure use case, as evidenced by "Example #1 Get and output the source of the homepage of a website", it is simply a wrapper for fopen(). if you can find a way to override the filename and pass a URL instead, you are either ignoring or in dire need of basic security practice – Zephyr

Answer 3

This is old topic but on my last test on one my API, cURL is faster and more stable. Sometimes file_get_contents on larger request need over 5 seconds when cURL need only from 1.4 to 1.9 seconds what is double faster.

I need to add one note on this that I just send GET and recive JSON content. If you setup cURL properly, you will have a great response. Just "tell" to cURL what you need to send and what you need to recive and that's it.

On your exampe I would like to do this setup:

$ch =  curl_init('http://api.bitly.com/v3/shorten?login=user&apiKey=key&longUrl=url');
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
    curl_setopt($ch, CURLOPT_HTTPAUTH, CURLAUTH_BASIC);
    curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 5);
    curl_setopt($ch, CURLOPT_TIMEOUT, 3);
    curl_setopt($ch, CURLOPT_HTTPHEADER, array('Accept: application/json'));
$result = curl_exec($ch);

This request will return data in 0.10 second max

Benign

0.1 MICROseconds (1/1,000 of a MILIseconds) ... I find that hard to believe. – Catron

Yes. I have some responses in 0.02ms for example Twilio API phone number check. Is fast. – Clairvoyant

0.02ms = 20 microseconds; you said 0.1 microseconds which can't be right. – Quilmes

This is almost twice as fast compare to file_get_contents I just did some API calls to confirm. 0.8 seconds for file_get_contents & 0.49 seconds for curl (3 API calls) – Mate

You should use your own setup. Then your queries would go from 1.4-1.9s to 0.01s ;) – Hawking

Answer 4

I know it is an old topic but I believe this is really important. And now, there are a lot of differences more than 8 years ago. As we all know, Curl is 3rd part library.

Simple Comparison: Last version of Curl library has more than 170 different functions to be able to send proper request to APIs. There were only 70 functions 8 years ago. Fact: still under development.

That's why I wanted to put a new comment to this question.

What is file_get_contents()

file_get_contents() is a filesystem function in PHP that you can read contents from a file and make requests using GET and POST methods. You can add parameters to your request while you're using file_get_contents() function. You can see the sample below.

$data = http_build_query(
    array(
        'user_id'   => '558673',
        'user_name' => 'John Doe'
    )
);

$config = array('http' =>
    array(
        'method'  => 'POST',
        'header'  => 'Content-Type: application/x-www-form-urlencoded',
        'content' => $data
    )
);

$context = stream_context_create($config);

$result = file_get_contents('https://google.com', false, $context);

What is curl()

Curl is open source third party library. You can reach the git repo from here. This function "simulates" HTTP requests and responses. This simulation allows you handling async HTTP requests and complex data transfers. In addition, Curl is suitable for performing cross-domain based FTP request. It can be used in various apps like data crawling from a website and proxy setup.

Let's check a CURL request syntax.

$url = API_ENDPOINT."/get_movies";
        
  $curl = curl_init();
         
  $params = array(
    'category' => $category,
    'limit' => $limit,
    'start' => $start,
    'order' => $order,
    'term' => $term
  );

  $params_string = http_build_query($params);

  curl_setopt($curl, CURLOPT_URL, $url);
  curl_setopt($curl, CURLOPT_POST, TRUE);
  curl_setopt($curl, CURLOPT_POSTFIELDS, $params_string);
  curl_setopt($curl, CURLOPT_RETURNTRANSFER, TRUE);
  
  $data = curl_exec($curl);     
  curl_close($curl);

  echo json_decode($data,TRUE); //service returns json in this sample

Note: This is the basic sample of a curl request. You can add more parameter and options to the curl object using its functions like CURLOPT_HTTPHEADER, CURLOPT_SSL_VERIFYPEER. These kind of parameters all up to you and the service that you trying to use.

CURL vs file_get_contents()

• CURL is able to handle complex HTML communications, but file_get_contents() is not.
• CURL supports HTTP PUT, GET, POST but file_get_contents() supports simple HTTP GET and HTTP POST requests.
• CURL supports caching and cookies but file_get_contents() doesn’t support caching, cookies, etc.
• CURL is able to use HTTP, HTTPS, FTP, FTPS and more. file_get_contents() uses HTTP and HTTPS protocols for communications.
• CURL can be used to read, update and delete files from server, but file_get_contents() only allows you to read a file.
• CURL is more secure and faster than file_get_contents()
• CURL is bit more complex to understand than file_get_contents().

Linseylinseywoolsey