Are URL hooks supposed to support access to php://input when the request is sent as application/x-www-form-urlencoded?

[adrianbj]

Hi @ryancramerdesign - sorry, not sure if this is a bug, intentional, or unavoidable.

I send application/json and application/x-www-form-urlencoded payloads to an endpoint created with a URL hook and file_get_contents('php://input') works as expected with application/json, but not with application/x-www-form-urlencoded.

Is there a way that application/x-www-form-urlencoded data could be made available via $event? Or populated to $_POST?

[ryancramerdesign]

I don't think PW has anything to do with that, I'm guessing it's something else? Does it work without PW?

…

On Thu, Oct 23, 2025, 6:00 PM Adrian Jones ***@***.***> wrote: *adrianbj* created an issue (processwire/processwire-issues#2149) <#2149> Hi @ryancramerdesign <https://github.com/ryancramerdesign> - sorry, not sure if this is a bug, intentional, or unavoidable. I send application/json and application/x-www-form-urlencoded payloads to an endpoint created with a URL hook and file_get_contents('php://input') works as expected with application/json, but not with application/x-www-form-urlencoded. Is there a way that application/x-www-form-urlencoded data could be made available via $event? — Reply to this email directly, view it on GitHub <#2149>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AACQEUHVZQ7AOYLQCKHMLYD3ZFFXDAVCNFSM6AAAAACKBWXZXWVHI2DSMVQWIX3LMV43ASLTON2WKOZTGU2DMNZVGU3DONY> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[adrianbj]

It even works in a .php file that bootstraps PW

[ryancramerdesign]

@adrianbj Can you confirm that the request method is POST? (I think that's required for php://input)

Also, I think that data sent with a content type of application/x-www-form-urlencoded or multipart/form-data means there won't be a php://input since PHP parses that content type internally? Though the php.ini setting enable_post_data_reading might be one way to change that.

[adrianbj]

@ryancramerdesign - file_get_contents('php://input') works just fine with a POST request with application/x-www-form-urlencoded content type in my PW bootstrapped endpoint.php file, so it's not an issue with how it's coming in.

You can testing very easily will a url hook with this inside it:

bd(file_get_contents('php://input'));

vs putting that in a endpoint.php file in the root of the site that bootstraps PW.

It returns an empty string when called inside the URL hook.

PS - I've tried $input->post and $_POST and neither work.

As a reminder, everything works with application/json

[ryancramerdesign]

@adrianbj Do you want to post the code you are using? Here's what I used to test, but was not able to duplicate the issue:

/site/ready.php

$wire->addHook('/hello/world', function($event) { 
  $data = file_get_contents("php://input");
  return "php://input contains: " .  print_r($data, true);
}); 

/test.php

<?php namespace ProcessWire; 
include("./index.php"); 
$http = new WireHttp();
$http->setHeader('content-type', 'application/x-www-form-urlencoded');
$response = $http->post('http://localhost:8888/hello/world', '{ "hello": "world", "foo": "bar" }');
print_r($response); 

output:

php://input contains: { "hello": "world", "foo": "bar" }

I also tried giving post() an array of vars instead:

$response = $http->post('http://localhost:8888/hello/world', [ 'hello' => 'world', 'foo' => 'bar' ]);

and got this:

php://input contains: hello=world&foo=bar

These both seem like the correct responses?

[adrianbj]

Hi @ryancramerdesign - I wonder if it's because even though you are setting the content type to application/x-www-form-urlencoded you are actually posting JSON.

In my case, the incoming headers are:

'Content-Type' => 'application/x-www-form-urlencoded'
'Content-Length' => '8001'
'X-Slack-Request-Timestamp' => '1761341771'
'X-Slack-Signature' => 'xxxxxxxxxxxxxxx'
'Accept' => 'application/json,*/*'
'Accept-Encoding' => 'gzip,deflate'
'User-Agent' => 'Slackbot 1.0 (+https://api.slack.com/robots)'
'Host' => 'mysite.com'
'Mod-Rewrite' => 'On'

and php://input is actually urlencoded - something like this:

'payload=%7B%22type%22%3A%22block_actions%22%2C%22user%22%3A%7B%22id%22%...............'

[adrianbj]

Hey Ryan,

Claude helped me figure this out 😁

"It won't work for application/x-www-form-urlencoded in a URL hook — php://input is empty because PHP already consumed it."

Just use $input->post('payload') — the data is already there in $_POST

So $data = file_get_contents("php://input"); won't work, but $input->post('payload') works just fine.

[adrianbj]

Just in case it's of interest, it initially suggested a new method in WireInput.php. It's not necessary with the $input->post('payload') approach, but thought I'd post here for reference.

	/**
	 * Cached raw request body from php://input
	 *
	 * @var string|null Null when not yet captured
	 *
	 */
	protected static $rawInputData = null;



	/**
	 * Get the raw request body
	 *
	 * Returns the raw request body from `php://input`. For `application/json` and other
	 * non-form content types, this returns the body directly. For `application/x-www-form-urlencoded`
	 * POST requests, PHP consumes `php://input` at startup to populate `$_POST`, so this method
	 * reconstructs the raw body from `$_POST` as a fallback.
	 *
	 * This is especially useful in URL hooks that receive webhook payloads or API requests
	 * where accessing `php://input` directly would return an empty string.
	 *
	 * ~~~~~
	 * // In a URL hook receiving a JSON payload
	 * $wire->addHook('/api/webhook/', function($event) {
	 *   $raw = $event->wire()->input->rawInput();
	 *   $data = json_decode($raw, true);
	 * });
	 *
	 * // In a URL hook receiving a urlencoded payload (e.g. Slack webhook)
	 * $wire->addHook('/api/slack/', function($event) {
	 *   $raw = $event->wire()->input->rawInput();
	 *   parse_str($raw, $data);
	 *   $payload = json_decode($data['payload'], true);
	 * });
	 * ~~~~~
	 *
	 * #pw-group-retrieval
	 *
	 * @return string Raw request body
	 * @since 3.0.258
	 *
	 */
	public function rawInput() {
		if(self::$rawInputData === null) {
			self::$rawInputData = file_get_contents('php://input');
			// For application/x-www-form-urlencoded POST requests, PHP consumes
			// php://input at SAPI startup to populate $_POST, leaving the stream empty.
			// Reconstruct the raw body from $_POST as a fallback.
			if(self::$rawInputData === '' && !empty($_POST) && $this->requestMethod() === 'POST') {
				$contentType = isset($_SERVER['CONTENT_TYPE']) ? $_SERVER['CONTENT_TYPE'] : '';
				if(stripos($contentType, 'application/x-www-form-urlencoded') !== false || $contentType === '') {
					self::$rawInputData = http_build_query($_POST);
				}
			}
		}
		return self::$rawInputData;
	}

[adrianbj]

Actually, it might not be this simple because $input->post('payload') is url_encoded so you can't reliably do a HMAC signature validation on it. Maybe the raw approach would help in this case.