PHP Curl – Cookies problem

cookiescurlPHP

I am trying to grab my amazon associates stats automatically via cUrl. However I am falling down at the first hurdle; logging in.

When I use the following code:

    $url = 'https://affiliate-program.amazon.com/gp/flex/sign-in/select.html';
    $post_data = "action=sign-in&email=$username&password=$password";

    $fp = fopen('/my/path/to/cookie.txt', 'w');
    fclose($fp);

    $login = curl_init();
    curl_setopt($login, CURLOPT_COOKIESESSION, 1);
    curl_setopt($login, CURLOPT_COOKIEJAR, '/my/path/to/cookie.txt');
    curl_setopt($login, CURLOPT_COOKIEFILE, '/my/path/to/cookie.txt');
    curl_setopt($login, CURLOPT_USERAGENT, 'Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)');
    curl_setopt($login, CURLOPT_TIMEOUT, 40);
    curl_setopt($login, CURLOPT_RETURNTRANSFER, 1);        
    curl_setopt($login, CURLOPT_URL, $url);
    curl_setopt($login, CURLOPT_HEADER, 1);        
    curl_setopt($login, CURLOPT_USERAGENT, $_SERVER['HTTP_USER_AGENT']);
    curl_setopt($login, CURLOPT_FOLLOWLOCATION, 1);
    curl_setopt($login, CURLOPT_POST, 1);
    curl_setopt($login, CURLOPT_POSTFIELDS, $post_data);
    echo curl_exec($login);
    curl_close($login);

I get the following output:

HTTP/1.1 200 OK Date: Thu, 22 Sep 2011 22:08:39 GMT Server: Server
x-amz-id-1: 1NNZMSS8X73EE0G7HKW8 x-amz-id-2:
HRW1ZoN4KVzDCp/tS5E7l+7fn9XGH2k/T7qxzi+WLOw= Set-cookie:
session-id-time=1317279600l; path=/; domain=.amazon.com; expires=Thu
Sep 29 07:00:00 2011 GMT Set-cookie: session-id=181-7755537-2127814;
path=/; domain=.amazon.com; expires=Thu Sep 29 07:00:00 2011 GMT Vary:
Accept-Encoding,User-Agent Cneonction: close Transfer-Encoding:
chunked Content-Type: text/html; charset=UTF-8 Please Enable Cookies
to Continue

To continue shopping at Amazon.com, please enable cookies in your Web
browser. Learn more about cookies and how to enable them.

Once you have enabled cookies in your browser, please click on the
button below to return to the previous page.

cookie.txt contains the following:

# Netscape HTTP Cookie File

# http://curl.haxx.se/rfc/cookie_spec.html

# This file was generated by libcurl! Edit at your own risk.

.amazon.com TRUE / FALSE 1317279600 session-id-time 1317279600l

.amazon.com TRUE / FALSE 1317279600 session-id 181-7755537-2127814

Live HTTP headers:

https://affiliate-program.amazon.com/gp/flex/sign-in/select.html

POST /gp/flex/sign-in/select.html HTTP/1.1 Host:

affiliate-program.amazon.com User-Agent: Mozilla/5.0 (Windows NT 6.0;

rv:6.0) Gecko/20100101 Firefox/6.0 Accept:

text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8

Accept-Language: en-gb,en;q=0.5 Accept-Encoding: gzip, deflate

Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Connection: keep-alive

Referer: https://affiliate-program.amazon.com/ Cookie:

apn-user-id=P0000000000; session-id-time=1317366000l;

session-id=182-9139891-5240049;

__utma=125759317.157031897.1316727783.1316727783.1316795373.2;

__utmz=125759317.1316727783.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none);

ubid-main=190-8295480-4625243; __utmv=125759317.koicarandsup-20;

x-main=qIM@jFtaFnr4KaiFFutR7WZ1QkQHqoq9;

at-main=4|eaxYjMp+5TWMiQOn6gROkHUvCfKF3Y9hkvacYbU0+fzL3Pr1ejcGt78Tb6W5zvUYj67hWyx3AuNd3UparIBCnnrL62d5IMyn7zeFKr7GfjnPvjjaGOPArk7n7tr7go+QgBU6OZ0hKse6MJIdApDrSe2cI0Mz9XDvbumEU5twDKgq338hejMR23IXuWrvq1o0hcfN6DS0oabY7mVIddSMig==;

__utmb=125759317; __utmc=125759317 Content-Type:

application/x-www-form-urlencoded Content-Length: 1276

sessionId=182-9139891-
5240049&path=%2Fgp%2Fassociates%2Flogin%2Flogin.html&query=returl%3D%2Fgp%2Fassociates%2Fjoin%2Flanding%2Fmain.html%26retquery%3D&action=sign-in&mode=1&email=xxx&password=xxx&x=31&y=18&metadata1=xppc1AIU%2Fl8IERp8RJxYooTCV9Vo2Nico9wyEvW9ByghGgc%2FSNU8XqMQnjgshs3DZpFQgLXCAT1qAama%2Bj5WBGxvTRiC45v6Am7hMY99RwJfUIozi5v1ZkwV%2Bcjp9PecvpcPSxLVuwOF4QSf7Q%2BPxNwlxLm5nHXqSNPwmw5Ezg2ENIagMWcrwuDlp50%2B0XKi0e8yyawdc5TjH%2BhGXz12KABRLoH1WuTSwAWleHzGzBUN515WgRMElB583b9h%2FoDINumjmwwsHsjzXjLaEjYaM1w6nw%2F5fqmpABPcN31D7wgDQoOi1xxIyUtZceAa3rwwUxKvpZecStM2T6QtSJhx6YdpLNmHwGSdhkBrsCQVlcLruKNMnUVrb%2FZni3le380YsUeIsVZy113lqayCwla9vwvDTA4mstx2YTKtTU1NOzfblMlYBEL4rhLN1fpeF0EaiAoiatLb1kH%2BCvt6tp78KyPCd0XeEBGqMeDWm2b%2FBSg%2BUqVLBMSeHtJ4VZXxMaWhodZZYU0uxUNwL8hCVruO5KxSbssorByNybuPx%2FmkS87UZMDB62VALgb90MUXLvbVX%2BcmizzBkmwCs3Q6ampHa40NIYQKXTCCnGjVUwavCPv73OrMA8OjVJX3h371m3OHvzpBKRTFG5uiTfZoaaPI%2FYxikE2v99%2FaR3vlwkTZfOhM%2Fba9seIbMpxArTj6ekpmTLbU5LwKn2yVbiAZgsUuFSCNcQMlE%2FJ9nAIuYZ2guks0Zz%2BPhJ07TOXuTscuc%2Fm0wgqqluPq5NShRINoiGLjiKva6ngslLoQWeKovNwYyVCyNfuwsZ7BIo6%2Fo7yaEfIK6Yb%2BZPMommN%2FI7BFrlW7wrWmaG%2FgbtSx1bg9A5DgtKBDI21j3ibebBZVN%2FP2ZrEB6upCDHEKa1pMCkP6nbOhu%2BxcrNYS%2FyS6e0bv3WiWqugclX%2FnYmBWBdNunCFtI8LKU%2FMvhDT820M%3D

HTTP/1.1 302 MovedTemporarily Date: Fri, 23 Sep 2011 16:30:35 GMT

Server: Server x-amz-id-1: 1JGFY8JCATS8GCJ05WP3 x-amz-id-2:

vNYWJ+3yN1Qrya1cxENZdlFuZNF4Yc4uYhCmoR3UFBU= Set-Cookie:

at-main=4|3iPYr7E1Pn32BbMI4MHFaMtbn/0v54qEG1Jn9Pk+7Hi2Cws1f+jBSUt9oyBzrpy6BX1XCsZ/qoJlbswA0G2U3L9Yhec4CjSlsLZM+mEPRs/AiNAbvuUDzj9wL1HI2x+e7tBqDLhK+fas6R562qkQBX+9Y7bhE1St11hjislFijGuTcbtr+5mUz1FuweEFaH/xtHacsJ3Yth9iOiska0CbQ==;

path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT;

secure Set-Cookie: ubid-main=190-8295480-4625243; path=/;

domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Location:

https://affiliate-program.amazon.com/gp/associates/join/landing/main.html

Vary: Accept-Encoding,User-Agent Content-Encoding: gzip nnCoection:

close Transfer-Encoding: chunked Content-Type: text/html;

charset=UTF-8

https://affiliate-program.amazon.com/gp/associates/join/landing/main.html

GET /gp/associates/join/landing/main.html HTTP/1.1 Host:

affiliate-program.amazon.com User-Agent: Mozilla/5.0 (Windows NT 6.0;

rv:6.0) Gecko/20100101 Firefox/6.0 Accept:

text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8

Accept-Language: en-gb,en;q=0.5 Accept-Encoding: gzip, deflate

Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Connection: keep-alive

Referer: https://affiliate-program.amazon.com/ Cookie:

apn-user-id=P0000000000; session-id-time=1317366000l;

session-id=182-9139891-5240049;

__utma=125759317.157031897.1316727783.1316727783.1316795373.2;

__utmz=125759317.1316727783.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none);

ubid-main=190-8295480-4625243; __utmv=125759317.koicarandsup-20;

x-main=qIM@jFtaFnr4KaiFFutR7WZ1QkQHqoq9;

at-main=4|3iPYr7E1Pn32BbMI4MHFaMtbn/0v54qEG1Jn9Pk+7Hi2Cws1f+jBSUt9oyBzrpy6BX1XCsZ/qoJlbswA0G2U3L9Yhec4CjSlsLZM+mEPRs/AiNAbvuUDzj9wL1HI2x+e7tBqDLhK+fas6R562qkQBX+9Y7bhE1St11hjislFijGuTcbtr+5mUz1FuweEFaH/xtHacsJ3Yth9iOiska0CbQ==;

__utmb=125759317; __utmc=125759317

HTTP/1.1 302 MovedTemporarily Date: Fri, 23 Sep 2011 16:30:36 GMT

Server: Server x-amz-id-1: 0DVGSNJ16FJ7BZSXKZEA x-amz-id-2:

3zBVVCqaFC6uLEb69n0ImqYEWcveHC/fr3DWJZ9XwfU= Set-Cookie:

ubid-main=190-8295480-4625243; path=/; domain=.amazon.com; expires=Tue

Jan 01 08:00:01 2036 GMT Location:

https://affiliate-program.amazon.com/gp/associates/network/main.html

Vary: Accept-Encoding,User-Agent Content-Encoding: gzip Cneonction:

close Transfer-Encoding: chunked Content-Type: text/html;

charset=UTF-8

https://affiliate-program.amazon.com/gp/associates/network/main.html

GET /gp/associates/network/main.html HTTP/1.1 Host:

affiliate-program.amazon.com User-Agent: Mozilla/5.0 (Windows NT 6.0;

rv:6.0) Gecko/20100101 Firefox/6.0 Accept:

text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8

Accept-Language: en-gb,en;q=0.5 Accept-Encoding: gzip, deflate

Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Connection: keep-alive

Referer: https://affiliate-program.amazon.com/ Cookie:

apn-user-id=P0000000000; session-id-time=1317366000l;

session-id=182-9139891-5240049;

__utma=125759317.157031897.1316727783.1316727783.1316795373.2;

__utmz=125759317.1316727783.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none);

ubid-main=190-8295480-4625243; __utmv=125759317.koicarandsup-20;

x-main=qIM@jFtaFnr4KaiFFutR7WZ1QkQHqoq9;

at-main=4|3iPYr7E1Pn32BbMI4MHFaMtbn/0v54qEG1Jn9Pk+7Hi2Cws1f+jBSUt9oyBzrpy6BX1XCsZ/qoJlbswA0G2U3L9Yhec4CjSlsLZM+mEPRs/AiNAbvuUDzj9wL1HI2x+e7tBqDLhK+fas6R562qkQBX+9Y7bhE1St11hjislFijGuTcbtr+5mUz1FuweEFaH/xtHacsJ3Yth9iOiska0CbQ==;

__utmb=125759317; __utmc=125759317

HTTP/1.1 200 OK Date: Fri, 23 Sep 2011 16:30:36 GMT Server: Server

x-amz-id-1: 02WEQDKB29RGKP5T4NWE x-amz-id-2:

xFfF8ncVlxX9KZtDLganiEY4CcDu+qXwkV5CBJGrKWY= Set-Cookie:

ubid-main=190-8295480-4625243; path=/; domain=.amazon.com; expires=Tue

Jan 01 08:00:01 2036 GMT Vary: Accept-Encoding,User-Agent

Content-Encoding: gzip Cneonction: close Transfer-Encoding: chunked

Content-Type: text/html; charset=UTF-8

V192206992.jpg">https://images-na.ssl-images-amazon.com/images/G/01/associates/network/thumb-slideshow-widget.V192206992.jpg

GET

/images/G/01/associates/network/thumb-slideshow-widget.V192206992.jpg

HTTP/1.1 Host: images-na.ssl-images-amazon.com User-Agent: Mozilla/5.0

(Windows NT 6.0; rv:6.0) Gecko/20100101 Firefox/6.0 Accept:

image/png,image/;q=0.8,/*;q=0.5 Accept-Language: en-gb,en;q=0.5

Accept-Encoding: gzip, deflate Accept-Charset:

ISO-8859-1,utf-8;q=0.7,*;q=0.7 Connection: keep-alive Referer:

https://affiliate-program.amazon.com/gp/associates/network/main.html

HTTP/1.1 200 OK Server: Server Content-Length: 4119 Last-Modified:

Wed, 02 Jun 2010 17:03:17 GMT Content-Type: image/jpeg X-Cache-Lookup:

HIT from cdn-images.amazon.com:8080, MISS from

cdn-images.amazon.com:10080 Cache-Control: max-age=607570264 Date:

Fri, 23 Sep 2011 16:30:37 GMT Connection: keep-alive

SL75.jpg">https://images-na.ssl-images-amazon.com/images/I/41WtSRWclnL.SL75.jpg

GET /images/I/41WtSRWclnL.SL75.jpg HTTP/1.1 Host:

images-na.ssl-images-amazon.com User-Agent: Mozilla/5.0 (Windows NT

6.0; rv:6.0) Gecko/20100101 Firefox/6.0 Accept:

image/png,image/;q=0.8,/*;q=0.5 Accept-Language: en-gb,en;q=0.5

Accept-Encoding: gzip, deflate Accept-Charset:

ISO-8859-1,utf-8;q=0.7,*;q=0.7 Connection: keep-alive Referer:

https://affiliate-program.amazon.com/gp/associates/network/main.html

HTTP/1.1 200 OK Server: Server Content-Length: 1317 Last-Modified:

Thu, 26 May 2011 11:17:40 GMT Content-Type: image/jpeg X-Cache-Lookup:

HIT from cdn-images.amazon.com:10080 Cache-Control: public,

max-age=628443948 Expires: Sat, 23 Aug 2031 08:16:25 GMT Date: Fri, 23

Sep 2011 16:30:37 GMT Connection: keep-alive

SL75.jpg">https://images-na.ssl-images-amazon.com/images/I/417XQ0XwQuL.SL75.jpg

GET /images/I/417XQ0XwQuL.SL75.jpg HTTP/1.1 Host:

images-na.ssl-images-amazon.com User-Agent: Mozilla/5.0 (Windows NT

6.0; rv:6.0) Gecko/20100101 Firefox/6.0 Accept:

image/png,image/;q=0.8,/*;q=0.5 Accept-Language: en-gb,en;q=0.5

Accept-Encoding: gzip, deflate Accept-Charset:

ISO-8859-1,utf-8;q=0.7,*;q=0.7 Connection: keep-alive Referer:

https://affiliate-program.amazon.com/gp/associates/network/main.html

HTTP/1.1 200 OK Server: Server Content-Length: 1321 Last-Modified:

Thu, 29 Jul 2010 04:26:28 GMT Content-Type: image/jpeg Cache-Control:

public, max-age=628496714 Expires: Sat, 23 Aug 2031 22:55:51 GMT Date:

Fri, 23 Sep 2011 16:30:37 GMT Connection: keep-alive

SL75.jpg">https://images-na.ssl-images-amazon.com/images/I/417tb3B43YL.SL75.jpg

GET /images/I/417tb3B43YL.SL75.jpg HTTP/1.1 Host:

images-na.ssl-images-amazon.com User-Agent: Mozilla/5.0 (Windows NT

6.0; rv:6.0) Gecko/20100101 Firefox/6.0 Accept:

image/png,image/;q=0.8,/*;q=0.5 Accept-Language: en-gb,en;q=0.5

Accept-Encoding: gzip, deflate Accept-Charset:

ISO-8859-1,utf-8;q=0.7,*;q=0.7 Connection: keep-alive Referer:

https://affiliate-program.amazon.com/gp/associates/network/main.html

HTTP/1.1 200 OK Server: Server Content-Length: 2462 Last-Modified:

Fri, 26 Jun 2009 04:52:12 GMT Content-Type: image/jpeg X-Cache-Lookup:

HIT from cdn-images.amazon.com:8080, MISS from

cdn-images.amazon.com:10080 Cache-Control: max-age=607635331 Date:

Fri, 23 Sep 2011 16:30:37 GMT Connection: keep-alive

SL75.jpg">https://images-na.ssl-images-amazon.com/images/I/41sh5uiQ83L.SL75.jpg

GET /images/I/41sh5uiQ83L.SL75.jpg HTTP/1.1 Host:

images-na.ssl-images-amazon.com User-Agent: Mozilla/5.0 (Windows NT

6.0; rv:6.0) Gecko/20100101 Firefox/6.0 Accept:

image/png,image/;q=0.8,/*;q=0.5 Accept-Language: en-gb,en;q=0.5

Accept-Encoding: gzip, deflate Accept-Charset:

ISO-8859-1,utf-8;q=0.7,*;q=0.7 Connection: keep-alive Referer:

https://affiliate-program.amazon.com/gp/associates/network/main.html

HTTP/1.1 200 OK Server: Server Content-Length: 1341 Last-Modified:

Thu, 15 Sep 2011 20:05:25 GMT Content-Type: image/jpeg X-Cache-Lookup:

MISS from cdn-images.amazon.com:10080 Cache-Control: public,

max-age=630611997 Expires: Wed, 17 Sep 2031 10:30:34 GMT Date: Fri, 23

Sep 2011 16:30:37 GMT Connection: keep-alive

utm.gif?utmwv=1&utmn=61668861&utmcs=UTF-8&utmsr=1280×1024&utmsc=24-bit&utmul=en-gb&utmje=1&utmfl=10.3%20r183&utmdt=Amazon.com%20Associates%20Central%20-%20Home&utmhn=affiliate-program.amazon.com&utmr=0&utmp=/gp/associates/network/main.html">https://affiliate-program.amazon.com/_utm.gif?utmwv=1&utmn=61668861&utmcs=UTF-8&utmsr=1280×1024&utmsc=24-bit&utmul=en-gb&utmje=1&utmfl=10.3%20r183&utmdt=Amazon.com%20Associates%20Central%20-%20Home&utmhn=affiliate-program.amazon.com&utmr=0&utmp=/gp/associates/network/main.html

GET

/__utm.gif?utmwv=1&utmn=61668861&utmcs=UTF-8&utmsr=1280×1024&utmsc=24-bit&utmul=en-
gb&utmje=1&utmfl=10.3%20r183&utmdt=Amazon.com%20Associates%20Central%20-%20Home&utmhn=affiliate-program.amazon.com&utmr=0&utmp=/gp/associates/network/main.html

HTTP/1.1 Host: affiliate-program.amazon.com User-Agent: Mozilla/5.0

(Windows NT 6.0; rv:6.0) Gecko/20100101 Firefox/6.0 Accept:

image/png,image/;q=0.8,/*;q=0.5 Accept-Language: en-gb,en;q=0.5

Accept-Encoding: gzip, deflate Accept-Charset:

ISO-8859-1,utf-8;q=0.7,*;q=0.7 Connection: keep-alive Referer:

https://affiliate-program.amazon.com/gp/associates/network/main.html

Cookie: apn-user-id=P0000000000; session-id-time=1317366000l;

session-id=182-9139891-5240049;

__utma=125759317.157031897.1316727783.1316727783.1316795373.2;

__utmz=125759317.1316727783.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none);

ubid-main=190-8295480-4625243; __utmv=125759317.koicarandsup-20;

x-main=qIM@jFtaFnr4KaiFFutR7WZ1QkQHqoq9;

at-main=4|3iPYr7E1Pn32BbMI4MHFaMtbn/0v54qEG1Jn9Pk+7Hi2Cws1f+jBSUt9oyBzrpy6BX1XCsZ/qoJlbswA0G2U3L9Yhec4CjSlsLZM+mEPRs/AiNAbvuUDzj9wL1HI2x+e7tBqDLhK+fas6R562qkQBX+9Y7bhE1St11hjislFijGuTcbtr+5mUz1FuweEFaH/xtHacsJ3Yth9iOiska0CbQ==;

__utmb=125759317; __utmc=125759317

HTTP/1.1 200 OK Date: Fri, 23 Sep 2011 16:30:37 GMT Server: Server

Last-Modified: Fri, 16 Sep 2011 11:22:34 GMT Etag: "23-35b3d280"

Accept-Ranges: bytes Content-Length: 35 Cneonction: close

Content-Type: image/gif

SL75.jpg">https://images-na.ssl-images-amazon.com/images/I/51993R08WLL.SL75.jpg

GET /images/I/51993R08WLL.SL75.jpg HTTP/1.1 Host:

images-na.ssl-images-amazon.com User-Agent: Mozilla/5.0 (Windows NT

6.0; rv:6.0) Gecko/20100101 Firefox/6.0 Accept:

image/png,image/;q=0.8,/*;q=0.5 Accept-Language: en-gb,en;q=0.5

Accept-Encoding: gzip, deflate Accept-Charset:

ISO-8859-1,utf-8;q=0.7,*;q=0.7 Connection: keep-alive Referer:

https://affiliate-program.amazon.com/gp/associates/network/main.html

HTTP/1.1 200 OK Server: Server Content-Length: 1325 Last-Modified:

Tue, 27 Jul 2010 16:47:41 GMT Content-Type: image/jpeg X-Cache-Lookup:

MISS from cdn-images.amazon.com:10080 Cache-Control: public,

max-age=628244375 Expires: Thu, 21 Aug 2031 00:50:12 GMT Date: Fri, 23

Sep 2011 16:30:37 GMT Connection: keep-alive

SL75.jpg">https://images-na.ssl-images-amazon.com/images/I/41is%2B997KUL.SL75.jpg

GET /images/I/41is%2B997KUL.SL75.jpg HTTP/1.1 Host:

images-na.ssl-images-amazon.com User-Agent: Mozilla/5.0 (Windows NT

6.0; rv:6.0) Gecko/20100101 Firefox/6.0 Accept:

image/png,image/;q=0.8,/*;q=0.5 Accept-Language: en-gb,en;q=0.5

Accept-Encoding: gzip, deflate Accept-Charset:

ISO-8859-1,utf-8;q=0.7,*;q=0.7 Connection: keep-alive Referer:

https://affiliate-program.amazon.com/gp/associates/network/main.html

HTTP/1.1 200 OK Server: Server Content-Length: 1662 Last-Modified:

Sun, 11 Nov 2007 01:27:41 GMT Content-Type: image/jpeg X-Cache-Lookup:

MISS from cdn-images.amazon.com:10080 Cache-Control: public,

max-age=628487843 Expires: Sat, 23 Aug 2031 20:28:00 GMT Date: Fri, 23

Sep 2011 16:30:37 GMT Connection: keep-alive

SL75.jpg">https://images-na.ssl-images-amazon.com/images/I/518ISDAvx1L.SL75.jpg

GET /images/I/518ISDAvx1L.SL75.jpg HTTP/1.1 Host:

images-na.ssl-images-amazon.com User-Agent: Mozilla/5.0 (Windows NT

6.0; rv:6.0) Gecko/20100101 Firefox/6.0 Accept:

image/png,image/;q=0.8,/*;q=0.5 Accept-Language: en-gb,en;q=0.5

Accept-Encoding: gzip, deflate Accept-Charset:

ISO-8859-1,utf-8;q=0.7,*;q=0.7 Connection: keep-alive Referer:

https://affiliate-program.amazon.com/gp/associates/network/main.html

HTTP/1.1 200 OK Server: Server Content-Length: 1111 Last-Modified:

Tue, 27 Jul 2010 00:37:08 GMT Content-Type: image/jpeg X-Cache-Lookup:

MISS from cdn-images.amazon.com:10080 Cache-Control: public,

max-age=628003065 Expires: Mon, 18 Aug 2031 05:48:22 GMT Date: Fri, 23

Sep 2011 16:30:37 GMT Connection: keep-alive

SL75.jpg">https://images-na.ssl-images-amazon.com/images/I/4155OOdySdL.SL75.jpg

GET /images/I/4155OOdySdL.SL75.jpg HTTP/1.1 Host:

images-na.ssl-images-amazon.com User-Agent: Mozilla/5.0 (Windows NT

6.0; rv:6.0) Gecko/20100101 Firefox/6.0 Accept:

image/png,image/;q=0.8,/*;q=0.5 Accept-Language: en-gb,en;q=0.5

Accept-Encoding: gzip, deflate Accept-Charset:

ISO-8859-1,utf-8;q=0.7,*;q=0.7 Connection: keep-alive Referer:

https://affiliate-program.amazon.com/gp/associates/network/main.html

HTTP/1.1 200 OK Server: Server Content-Length: 1494 Last-Modified:

Thu, 20 Aug 2009 15:52:47 GMT Content-Type: image/jpeg X-Cache-Lookup:

MISS from cdn-images.amazon.com:10080 Cache-Control: public,

max-age=630336792 Expires: Sun, 14 Sep 2031 06:03:49 GMT Date: Fri, 23

Sep 2011 16:30:37 GMT Connection: keep-alive

utm.gif?utmwv=1&utmt=var&utmn=1408273993">https://affiliate-program.amazon.com/_utm.gif?utmwv=1&utmt=var&utmn=1408273993

GET /__utm.gif?utmwv=1&utmt=var&utmn=1408273993 HTTP/1.1 Host:

affiliate-program.amazon.com User-Agent: Mozilla/5.0 (Windows NT 6.0;

rv:6.0) Gecko/20100101 Firefox/6.0 Accept:

image/png,image/;q=0.8,/*;q=0.5 Accept-Language: en-gb,en;q=0.5

Accept-Encoding: gzip, deflate Accept-Charset:

ISO-8859-1,utf-8;q=0.7,*;q=0.7 Connection: keep-alive Referer:

https://affiliate-program.amazon.com/gp/associates/network/main.html

Cookie: apn-user-id=P0000000000; session-id-time=1317366000l;

session-id=182-9139891-5240049;

__utma=125759317.157031897.1316727783.1316727783.1316795373.2;

__utmz=125759317.1316727783.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none);

ubid-main=190-8295480-4625243; __utmv=125759317.koicarandsup-20;

x-main=qIM@jFtaFnr4KaiFFutR7WZ1QkQHqoq9;

at-main=4|3iPYr7E1Pn32BbMI4MHFaMtbn/0v54qEG1Jn9Pk+7Hi2Cws1f+jBSUt9oyBzrpy6BX1XCsZ/qoJlbswA0G2U3L9Yhec4CjSlsLZM+mEPRs/AiNAbvuUDzj9wL1HI2x+e7tBqDLhK+fas6R562qkQBX+9Y7bhE1St11hjislFijGuTcbtr+5mUz1FuweEFaH/xtHacsJ3Yth9iOiska0CbQ==;

__utmb=125759317; __utmc=125759317

HTTP/1.1 200 OK Date: Fri, 23 Sep 2011 16:30:37 GMT Server: Server

Last-Modified: Fri, 16 Sep 2011 11:22:34 GMT Etag: "23-35b3d280"

Accept-Ranges: bytes Content-Length: 35 Cneonction: close

Content-Type: image/gif

Can anyone shed some light on why this is not working?

Best Answer

EDIT: This code is broken as of June 2016. See this answer for explanation and potential workaround. The same technology mentioned in the previous link was added to associates' login.

I wrote this code up and it works well for me, in the last var_dump I see all my account info and things like that. If you don't delete the cookies, you can make subsequent curl requests to protected pages with your login.

Hopefully this can help you learn about how to do it. A lot of times on big sites you need to visit the login page to get cookies set, and also they usually have csrf tokens on the forms you need to submit with them.

Of course if amazon changes their forms or url's around a bit, this will have to be adapted some, but hopefully they don't do that too often.

<?php

$email    = 'you@yoursite.com';
$password = 'password';

// initial login page which redirects to correct sign in page, sets some cookies
$URL = 'https://affiliate-program.amazon.com/gp/associates/join/landing/main.html';

$ch  = curl_init();

curl_setopt($ch, CURLOPT_URL, $URL);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'amazoncookie.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, 'amazoncookie.txt');
curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows NT 6.1; WOW64; rv:35.0) Gecko/20100101 Firefox/35.0');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_HEADER, 1);
//curl_setopt($ch, CURLOPT_VERBOSE, true);
curl_setopt($ch, CURLOPT_STDERR,  fopen('php://stdout', 'w'));
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);

$page = curl_exec($ch);

//var_dump($page);exit;

// try to find the actual login form
if (!preg_match('/<form name="sign_in".*?<\/form>/is', $page, $form)) {
    die('Failed to find log in form!');
}

$form = $form[0];

// find the action of the login form
if (!preg_match('/action=(?:\'|")?([^\s\'">]+)/i', $form, $action)) {
    die('Failed to find login form url');
}

$URL2 = $action[1]; // this is our new post url

// find all hidden fields which we need to send with our login, this includes security tokens
$count = preg_match_all('/<input type="hidden"\s*name="([^"]*)"\s*value="([^"]*)"/i', $form, $hiddenFields);

$postFields = array();

// turn the hidden fields into an array
for ($i = 0; $i < $count; ++$i) {
    $postFields[$hiddenFields[1][$i]] = $hiddenFields[2][$i];
}

// add our login values
$postFields['username'] = $email;
$postFields['password'] = $password;

$post = '';

// convert to string, this won't work as an array, form will not accept multipart/form-data, only application/x-www-form-urlencoded
foreach($postFields as $key => $value) {
    $post .= $key . '=' . urlencode($value) . '&';
}

$post = substr($post, 0, -1);

// set additional curl options using our previous options
curl_setopt($ch, CURLOPT_URL, $URL2);
curl_setopt($ch, CURLOPT_REFERER, $URL);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post);

$page = curl_exec($ch); // make request

var_dump($page); // should be logged in

Correctly setting up the connection

Note that when using PDO to access a MySQL database real prepared statements are not used by default. To fix this you have to disable the emulation of prepared statements. An example of creating a connection using PDO is:

$dbConnection = new PDO('mysql:dbname=dbtest;host=127.0.0.1;charset=utf8', 'user', 'password');

$dbConnection->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);
$dbConnection->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

In the above example the error mode isn't strictly necessary, but it is advised to add it. This way the script will not stop with a Fatal Error when something goes wrong. And it gives the developer the chance to catch any error(s) which are thrown as PDOExceptions.

What is mandatory, however, is the first setAttribute() line, which tells PDO to disable emulated prepared statements and use real prepared statements. This makes sure the statement and the values aren't parsed by PHP before sending it to the MySQL server (giving a possible attacker no chance to inject malicious SQL).

Although you can set the charset in the options of the constructor, it's important to note that 'older' versions of PHP (before 5.3.6) silently ignored the charset parameter in the DSN.

Explanation

The SQL statement you pass to prepare is parsed and compiled by the database server. By specifying parameters (either a ? or a named parameter like :name in the example above) you tell the database engine where you want to filter on. Then when you call execute, the prepared statement is combined with the parameter values you specify.

The important thing here is that the parameter values are combined with the compiled statement, not an SQL string. SQL injection works by tricking the script into including malicious strings when it creates SQL to send to the database. So by sending the actual SQL separately from the parameters, you limit the risk of ending up with something you didn't intend.

Any parameters you send when using a prepared statement will just be treated as strings (although the database engine may do some optimization so parameters may end up as numbers too, of course). In the example above, if the $name variable contains 'Sarah'; DELETE FROM employees the result would simply be a search for the string "'Sarah'; DELETE FROM employees", and you will not end up with an empty table.

Another benefit of using prepared statements is that if you execute the same statement many times in the same session it will only be parsed and compiled once, giving you some speed gains.

Oh, and since you asked about how to do it for an insert, here's an example (using PDO):

$preparedStatement = $db->prepare('INSERT INTO table (column) VALUES (:column)');

$preparedStatement->execute([ 'column' => $unsafeValue ]);

Can prepared statements be used for dynamic queries?

While you can still use prepared statements for the query parameters, the structure of the dynamic query itself cannot be parametrized and certain query features cannot be parametrized.

For these specific scenarios, the best thing to do is use a whitelist filter that restricts the possible values.

// Value whitelist
// $dir can only be 'DESC', otherwise it will be 'ASC'
if (empty($dir) || $dir !== 'DESC') {
   $dir = 'ASC';
}

How to send a header using a HTTP request through a cURL call

man curl:

   -H/--header <header>
          (HTTP)  Extra header to use when getting a web page. You may specify
          any number of extra headers. Note that if you should  add  a  custom
          header that has the same name as one of the internal ones curl would
          use, your externally set header will be used instead of the internal
          one.  This  allows  you  to make even trickier stuff than curl would
          normally do. You should not replace internally set  headers  without
          knowing  perfectly well what you're doing. Remove an internal header
          by giving a replacement without content on the  right  side  of  the
          colon, as in: -H "Host:".

          curl  will  make sure that each header you add/replace get sent with
          the proper end of line marker, you should thus not  add  that  as  a
          part  of the header content: do not add newlines or carriage returns
          they will only mess things up for you.

          See also the -A/--user-agent and -e/--referer options.

          This option can be used multiple times to add/replace/remove  multi-
          ple headers.

Example:

curl --header "X-MyHeader: 123" www.google.com

You can see the request that curl sent by adding the -v option.

Best Answer

Related Solutions

Php – How to prevent SQL injection in PHP

Correctly setting up the connection

Explanation

Can prepared statements be used for dynamic queries?

How to send a header using a HTTP request through a cURL call

Example:

Related Topic