cURL in PHP
debt(d5/e3/b5/t5)
Closest to 'specialist tool catches' (d5). The term's detection_hints specify semgrep and psalm as tools that can catch the common misconfigurations (CURLOPT_SSL_VERIFYPEER=false, missing CURLOPT_TIMEOUT, unbounded redirects). These are specialist static analysis tools, not default linters that run automatically in most PHP setups.
Closest to 'simple parameterised fix' (e3). The quick_fix indicates adding proper CURLOPT settings is straightforward — setting CURLOPT_TIMEOUT, ensuring CURLOPT_SSL_VERIFYPEER=true, and adding CURLOPT_MAXREDIRS. However, fixing SSRF vulnerabilities from user-controlled URLs may require adding IP validation logic across multiple call sites, pushing slightly beyond e1 into e3 territory.
Closest to 'persistent productivity tax' (b5). Per applies_to, cURL is used across web, cli, and queue-worker contexts — it's a cross-cutting HTTP client choice. Every outbound HTTP request in the codebase must correctly configure these options. The pattern of proper cURL configuration becomes a persistent concern that affects multiple work streams, though it doesn't define the system's architecture.
Closest to 'notable trap' (t5). The misconception field explicitly states that while CURLOPT_SSL_VERIFYPEER defaults to true in modern PHP, many hosts and tutorials set it to false — developers following outdated tutorials or copying Stack Overflow snippets will disable SSL verification. The silent failure behavior (not checking curl_errno/curl_error) is another documented gotcha that most PHP developers eventually learn the hard way.
Also Known As
TL;DR
Explanation
PHP's cURL extension (libcurl bindings) supports HTTP/1.1, HTTP/2, HTTPS, FTP, proxies, authentication, cookies, and multipart uploads. Key security considerations: never disable CURLOPT_SSL_VERIFYPEER or CURLOPT_SSL_VERIFYHOST in production — always validate certificates with a trusted CA bundle. Set timeouts (CURLOPT_CONNECTTIMEOUT, CURLOPT_TIMEOUT) to prevent hanging requests. Use CURLOPT_FOLLOWLOCATION cautiously — it can enable SSRF. For modern code, consider Guzzle (which wraps cURL) for a cleaner API, middleware support, async requests, and automatic retry logic.
Common Misconception
Why It Matters
Common Mistakes
- Setting CURLOPT_SSL_VERIFYPEER to false — disables certificate validation entirely, enabling MITM.
- Not setting a CURLOPT_TIMEOUT — a slow server blocks the PHP process indefinitely.
- Passing user-controlled URLs to curl_init() without IP validation — enables SSRF.
- Not checking curl_errno() and curl_error() after execution — silent failures masquerade as empty responses.
Code Examples
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // disables certificate validationcurl_setopt($ch, CURLOPT_CAINFO, '/etc/ssl/certs/ca-certificates.crt');
curl_setopt($ch, CURLOPT_TIMEOUT, 10);