How to sandbox a request to another PHP script?
<p>I have a primarily Ajax-driven site, the content of which is populated by making requests to an "operator" PHP script.</p>

<p>While typically these requests originate in Javascript, there are occasions when it's useful to query my operator from within another PHP script.</p>

<p>The method I have been using is to pass a URL with query string through <code>file_get_contents()</code> — and then to parse the returned JSON with <code>json_decode()</code>.</p>

<p>For multiple reasons, I'd like to avoid this implementation, though... I see in my error logs that the URL requests are a lot more susceptible to failure for whatever reason — and I've read that it's not very efficient.</p>

<p>My 1st attempt to make a generic <code>query_operator($query_string)</code>-type function simply <code>require()</code>-ed <code>operator.php</code> within an output buffer, captured with <code>ob_get_contents()</code>.  I also temporarily reset the $_REQUEST array with parameters parsed from the <code>$query_string</code>.</p>

<p>This approach had too many shortcomings — problems with variable scope and the MySQL connection, specifically.</p>

<p>My 2nd attempt involved using the backtick operator (equivalent to <code>shell_exec()</code>), and mapping the <code>$argv</code> arguments to the <code>$_REQUEST</code> array.</p>

<p>This approach actually works very well, but on the host I'm using, the PHP (cli) version is set a 4.4.8 — and I need 5.2.x.  Assuming I can't switch the (cli) version, what's the next best way to sandbox a request to another PHP script, with a query string?  Any suggestions greatly appreciated.</p>

<p>Here's what my 2nd attempt looks like:</p>

<pre><code>function query_operator($query) {
    $query = '--'.str_ireplace('&amp;', ' --', $query);
    $contents = `php operator.php $query`;
    if ($json = json_decode($contents, true)) {
        return $json;
    } else {
        return $contents;
    }
}
</code></pre>
