Using proc_open the ps command can see:
gpg -e -r 'Recipient'Using exec the ps command can see:
echo SECRET | gpg -e -r 'Recipient'Which one would you rather have?
Below i've provided some example code that can call gpg with proc_open. It will return the gpg result or the word "error" if there has been some kind of gpg error that did not produce a result.
/*---------------------------------------------------------------------------*/
// encrypt_command
//
// sends data to encrypt to stdin, returns result code
//
// expects a gpg command like
// /usr/bin/gpg --homedir /path/to/.gnupg --armor --batch -e -r 'Recipient'
//
/*---------------------------------------------------------------------------*/
function encrypt_command ($gpg_command, $data)
{
$descriptors = array(
0 => array("pipe", "r"), //stdin
1 => array("pipe", "w"), //stdout
2 => array("pipe", "w"), //stderr
);
$process = proc_open($gpg_command, $descriptors, $pipes);
if (is_resource($process)) {
// send data to encrypt to stdin
fwrite($pipes[0], $data);
fclose($pipes[0]);
// read stdout
$stdout = stream_get_contents($pipes[1]);
fclose($pipes[1]);
// read stderr
$stderr = stream_get_contents($pipes[2]);
fclose($pipes[2]);
// It is important that you close any pipes before calling
// proc_close in order to avoid a deadlock
$return_code = proc_close($process);
$return_value = trim($stdout, "\n");
//echo "$stdout";
if (strlen($return_value) < 1) {
$return_value = "error: $stderr";
}
}
return $return_value;
}
/*---------------------------------------------------------------------------*/
// decrypt_command
//
// sends passphrase to stdin, returns decrypted data
//
// expects a gpg command like:
// /usr/bin/gpg --homedir /path/to/.gnupg --passphrase-fd 0 --decrypt file.gpg
//
/*---------------------------------------------------------------------------*/
function decrypt_command ($gpg_command, $passphrase)
{
$descriptors = array(
0 => array("pipe", "r"), //stdin
1 => array("pipe", "w"), //stdout
2 => array("pipe", "w"), //stderr
);
$process = proc_open($gpg_command, $descriptors, $pipes);
if (is_resource($process)) {
// send passphrase to stdin
fwrite($pipes[0], $passphrase);
fclose($pipes[0]);
// read stdout
$stdout = stream_get_contents($pipes[1]);
fclose($pipes[1]);
// read stderr
$stderr = stream_get_contents($pipes[2]);
fclose($pipes[2]);
// It is important that you close any pipes before calling
// proc_close in order to avoid a deadlock
$return_code = proc_close($process);
$return_value = trim($stdout, "\n");
//echo "$stdout";
if (strlen($return_value) < 1) {
$return_value = "error: $stderr";
}
}
return $return_value;
}
