Phil Sturgeon has a new post to his site today looking at a new feature that's included with PHP 5.5, Curlfile, and how he uses it with calls to the Facebook API (and a fix to make it cooperate).

One of the features implemented in PHP 5.5 was CurlFile, a nice addition to the Curl extension to allow you to specify specific arguments as a file for upload. In previous versions (pre-PHP 5.5) the syntax looked like this: [@/foo/bar.jpg]. A little digging around lead me to try this syntax: [new CURLFile('/foo/bar.jpg','image/jpeg')]. Sadly while Curl was happy with this, the Facebook PHP SDK (v3.2.2) was not. It turns out the SDK will turn ANY value you send it in that params array into a string.

To get around the issue, he worked up his own fix to the Facebook PHP SDK and submitted a patch to get it introduced into the tool. He also includes a reminder to filter incoming user data for things containing the "@" too to prevent unwanted file transfers.