Is it really impossible to write a php cli password hint that hides the password in windows?

Question

I spent several hours trying to find a way to write a cross-platform password in php that hides the password that the user enters. Although it is easy to do this on Unix environments with stty -echo, I tried various ways to call passthru () and system () to make windows do the same to no avail.

I tried:

passthru('set /p pass=Password: ');
system('echo %pass% > out.txt');
$pass = file_get_contents('out.txt', 'r');

This is like hanging on passthru ('set / p pass = Password:'); line, not allowing me to enter any text and should be killed with Ctrl-c.

I also tried various fgetc and fgets methods and print backspace characters to hide input as this works in other languages. However, PHP cannot interact with the text until the carriage returns.

I would really like to find a way to make this work, is this an impossible task or is it something that can be done?

Please note that I know that I can wrap a php script in a batch file and pass the password as a command line argument, but this does not work in this case.

Answer 1

Here is a Windows solution using the COM extension for PHP. I tested this on Windows XP with PHP 5.2.6.

<?php

$pwObj = new Com('ScriptPW.Password');

print "Password: ";
$passwd = $pwObj->getPassword();

echo "Your password is $passwd\n";

?>

Answer 2

It seems that for PHP there is no IOCTL or STTY extension. I found the following trick here :

<?php
echo 'Password: ';
$pwd = preg_replace('/\r?\n$/', '', `stty -echo; head -n1 ; stty echo`);
echo "\n";
echo "Your password was: {$pwd}.\n";
?>

Answer 3

, PHP , :

, *. , *...

Ergonomic, this is convenient because the user can see what he has entered. Security is not at risk, because if someone can see the password in one letter for one letter, he can see that the guy types it all the same on the keyboard. But it still prevents someone from seeing it by chance at one time.