PHP SAPI Types (FPM, CLI, Embed)
TL;DR
SAPI (Server API) defines how PHP is invoked — php-fpm for web requests, php-cli for commands, embed for C extensions — each has different lifecycle and configuration.
Explanation
PHP SAPIs: php-fpm (FastCGI Process Manager) — long-running pool of workers handling web requests, separate PHP-FPM pool config, per-request memory reset. php-cli — single execution, unlimited max_execution_time by default, used for scripts, cron, queues. php-cgi — legacy CGI, spawned per request. apache2handler — mod_php embedded in Apache. embed — PHP embedded in C apps. php_sapi_name() returns the SAPI name. Key differences: superglobals ($_SERVER, $_REQUEST) only populated in web SAPIs. STDIN/STDOUT available in CLI. php-fpm pools can have per-pool php.ini overrides. Workers share nothing between requests — no state persistence without external storage (Redis, DB).
Common Misconception
✗ PHP-FPM workers persist state between requests — each request gets a fresh PHP environment. State must be stored externally.
Why It Matters
Understanding SAPIs prevents SAPI-specific code from being used in the wrong context and helps configure each correctly for performance and security.
Common Mistakes
- Using CLI-only functions (readline, pcntl) in web context.
- Not setting different memory_limit/max_execution_time per SAPI.
- Assuming $_SERVER is populated in CLI scripts.
Code Examples
✗ Vulnerable
// In web request — reads from stdin, only works in CLI:
$input = fgets(STDIN); // Returns false in FPM
✓ Fixed
// SAPI detection:
if (PHP_SAPI === 'cli') {
$input = fgets(STDIN);
} else {
$input = $_POST['data'] ?? '';
}
// Check in code:
echo PHP_SAPI; // 'fpm-fcgi', 'cli', 'apache2handler' etc
Tags
🤝 Adopt this term
£79/year · your link shown here
Added
23 Mar 2026
Views
29
🤖 AI Guestbook educational data only
|
|
Last 30 days
Agents 0
No pings yet today
No pings yesterday
Perplexity 7
Amazonbot 6
Unknown AI 4
ChatGPT 3
Google 2
Meta AI 1
Ahrefs 1
Also referenced
How they use it
crawler 22
pre-tracking 2
Related categories
⚡
DEV INTEL
Tools & Severity
🟢 Low
⚙ Fix effort: Low
⚡ Quick Fix
Use PHP_SAPI constant to conditionally run SAPI-specific code. Configure separate php.ini pools for FPM vs CLI with appropriate limits.
📦 Applies To
PHP 4.0+
web
cli
🔗 Prerequisites
🔍 Detection Hints
PHP_SAPI|php_sapi_name
Auto-detectable:
✗ No
phpstan
🤖 AI Agent
Confidence: Low
False Positives: High
✗ Manual fix
Fix: Low
Context: File