I have seen various methods to control the GPIO pins via a web interface. A few include

  1. Python loop pinging for instruction in a MySQL db
  2. Running NodeJS as the scripting language and webserver
  3. Interfacing socket.io with NodeJS
  4. Giving www-data sudo privileges

I already have a lot of PHP code in place that I do not want to convert to Node, so 2 is out. 4 is very insecure. My question comes down to which method is more efficient? Calling a NodeJS script via socket.io or pinging a MySQL db with python?


I personally like sudo or super for this when combined with a traditional cgi, and security can be managed to minimize risk (this can be done securely). The main criticism of cgi for large scale projects is because it forks for every request it does not work well with large numbers of requests. This criticism does not apply in this case because the main limit of bandwidth to this cgi script is what is connected to the gpio pins, and forking allows the script to run in different security context then the web server.

There are some common mistakes that should be avoided:

  1. Use of a password with sudo. This is hard to do, prone to mistakes and seldom provides any benefit.

  2. Allowing full permission to the web server. The www-data user only needs to run one script for this to work. It does not need full root access. This can be done easily with sudo.

Pieces of the puzzle.

  1. the web server.

  2. wrapper.cgi: this program is called as www-data by the web server it calls sudo or super.

  3. sudo or super with a configuration file that only allows www-data to call real.cgi

  4. real.cgi: This program writes to gpio after preforming final checks. Be very careful when writing this.


My plan as I am approaching the same thing here soon is to use a Text file to write to at the time of user input on the UI and a cron job to execute a python script every minute that parses an array of files in a given directory that will have instructions for each Relay.

Relay_01.txt Relay_02.txt Relay_03.txt

contents = simple strings of True and false at the moment.

I have tested this at a very low level and it seems like it will work.

I also had some disk limitations and had to cut corners to save disk space on installing a MySQL instance. I don't have to worry about any sort of sql injection problems either.

I don't know it's kind of a weak process but sometimes simple works. Its also not directly listed in your Choices so I thought I would throw it out there.

  • There are three problems with this approach. They may not apply in your case or can be worked around. The first as you are aware is latency, there is a delay between the user's action and the devices response. The second is feedback, you can't tell if it worked. And third this does not guarantee that it is impossible to pass bad data from the web to the secure script. You still need to validate your input. – hildred Feb 20 '14 at 4:42
  • Excellent points. I did have initially concerns on my project about latency but the 60 second max window was no problem. I countered the feedback with logging and reading for particular entries although it doesn't account for the relay hardware not actually working. – ssaviers Feb 21 '14 at 5:34

To answer your question:

Calling a NodeJS script via socket.io or pinging a MySQL db with python?

I think it's better to use NodeJS with socket.io. You can add it easily to your php code and you can extend it. Running a MySQL db just for that case isn't right. And pinging it for changes is not state of the art, because of that there is socket.io.


What I do is that I have some scripts in sh and then I call them from php using exec("myscrip.sh") and they deal with the HW stuff or the python things in bellow

As for the authentication problem I follow an approach I learned here:use batman user

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.