Interactive CLI password prompt in PHP

Just a quick tip, since I spent a good hour figuring this out recently. PHP has no native way of doing an interactive password prompt, when running as CLI. You can however use bash for the task. Of course this means that it won’t work on Windows, but you should be fine on most anything else. Edit: Using Windows Scripting Host, it’s possible to pop a prompt up for the user to type in. I’ve extended the example to use this technique for Windows based systems.


/**
 * Interactively prompts for input without echoing to the terminal.
 * Requires a bash shell or Windows and won't work with
 * safe_mode settings (Uses `shell_exec`)
 */
function prompt_silent($prompt = "Enter Password:") {
  if (preg_match('/^win/i', PHP_OS)) {
    $vbscript = sys_get_temp_dir() . 'prompt_password.vbs';
    file_put_contents(
      $vbscript, 'wscript.echo(InputBox("'
      . addslashes($prompt)
      . '", "", "password here"))');
    $command = "cscript //nologo " . escapeshellarg($vbscript);
    $password = rtrim(shell_exec($command));
    unlink($vbscript);
    return $password;
  } else {
    $command = "/usr/bin/env bash -c 'echo OK'";
    if (rtrim(shell_exec($command)) !== 'OK') {
      trigger_error("Can't invoke bash");
      return;
    }
    $command = "/usr/bin/env bash -c 'read -s -p ""
      . addslashes($prompt)
      . "" mypassword && echo $mypassword'";
    $password = rtrim(shell_exec($command));
    echo "n";
    return $password;
  }
}

Free book: Jump Start HTML5 Basics

Grab a free copy of one our latest ebooks! Packed with hints and tips on HTML5's most powerful new features.

  • Coder Jim

    Will it work on Windows with Cygwin Tools installed? That’s almost a bash, right?

  • magnusdopus

    We used php-gtk for this. Works great on windows!

  • Lachlan
  • Troels Knak-Nielsen

    @magnusdopus: Good tip. The only downside is that it adds a pretty heavy dependency if you aren’t already using gtk for anything else. I was thinking that it must be possible to use windows scripting host to pop up a modal box somehow, but I haven’t investigated further.

    @Coder Jim: In theory, but Cygwin has some problems with interactive shell features, so I wouldn’t be surprised if it didn’t work. Haven’t tried it though.

    @Lachlan: readline echoes input to the screen.

  • Anonymous

    something like this could work at Win.

    prompt.vbs:

    pass = InputBox("Input password", "", "password here")
    wscript.echo pass

    prompt.php:

    echo (exec('cscript //nologo prompt.vbs'));

    If promp.vbs and prompt.php are in same folder and php is Path, cmd could be e.g.:
    D:>php prompt.php

  • ognjen

    Of course, in example above, vbs script should be in two lines.
    Or in one:

    wscript.echo InputBox("Input password", "", "password here")

  • Troels Knak-Nielsen

    @ognjen: Yeah, WordPress messes peoples comments up. It’s rather annoying.

    I just tested it on Windows and it works. It would be nice to do without the vbs file, but I guess the php-script could just generate it as a temp-file, and delete it afterwards.

    The InputBox doesn’t mask the password, but it seems to be possible to do, using a few more lines of vb-script:


    Wscript.Echo(CreateObject("ScriptPW.Password").GetPassword())

  • Troels Knak-Nielsen

    OK, I couldn’t get the ScriptPW trick to work, but I’ve now updated the snippet above to use the basic password-prompt, if the OS is Windows. This should make the function fully portable.

  • Robert K

    Not bad at all – i’ve just been using javascript based techniques. This looks very useful also php-gtk looks good also. Thanks!

  • irshad_sheikh

    Nice code.

  • Dave

    This works great. Thanks!