PHP stream contexts configure I/O wrappers for timeout, TLS, headers and other wrapper-specific options; they do not change stream security defaults by themselves.
What It Does
php://temp can spill from memory to a temporary file past its threshold. A stream context configures wrappers but does not provide SSRF protection.
Requirements and Compatibility
Use a supported PHP runtime and install any third-party tool or extension explicitly shown in the examples. Commands should be run from the project root unless stated otherwise.
Syntax, Inputs and Results
The examples separate configuration, the smallest working operation and a realistic follow-up task. Adapt file paths and dependency versions to your own project.
Example 1: Basic Use
php://temp can spill from memory to a temporary file past its threshold.
<?php
$stream = fopen('php://temp/maxmemory:1048576', 'w+');
fwrite($stream, str_repeat('a', 2048));
rewind($stream);
echo strlen(stream_get_contents($stream));
fclose($stream);Example 2: Another Case
A stream context configures wrappers but does not provide SSRF protection.
<?php
$context = stream_context_create(['http' => ['timeout' => 3, 'follow_location' => 0]]);
// For a fixed trusted endpoint only:
// $body = file_get_contents('https://api.example.test/status', false, $context);
var_dump(stream_context_get_options($context));Practical Example
Copy streams without materializing the entire source as a PHP string.
<?php
$source = fopen('php://memory', 'w+');
fwrite($source, 'sample data');
rewind($source);
$target = fopen('php://temp', 'w+');
echo stream_copy_to_stream($source, $target), ' bytes';
fclose($source);
fclose($target);For production, apply the compatibility and edge-case limits described below.
Important Behavior and Edge Cases
A stream context does not automatically validate a URL or make an HTTP request safe.
Comparison with Related Functions and Tools
| Subject | Key difference |
|---|---|
| Stream context vs stream resource | The context configures supported wrappers; the opened stream represents a live I/O handle. |
Common Beginner Mistakes
| Mistake | Correct approach |
|---|---|
| Assuming wrapper URLs are safe user input | Use fixed schemes, validated destinations, timeouts and appropriate redirect policies. |
| Skipping the prerequisite of this specific workflow | Install or configure the named tool and confirm the example can actually run. |
| Ignoring edge conditions | A stream context does not automatically validate a URL or make an HTTP request safe. |
Key Takeaways
- PHP stream contexts configure I/O wrappers for timeout, TLS, headers and other wrapper-specific options; they do not change stream security defaults by themselves.
- A stream context does not automatically validate a URL or make an HTTP request safe.
- Keep application configuration, source code and validation tests under version control.
Use these examples as a starting point, then validate the result with the actual PHP build, dependencies and inputs used by your application.