VK.com CURL authorization (without standart API)

Few days ago I decided to write a bot for http://olike.ru. Bot was successfully written, but one of my VK.com accounts was frozen for few minutes. So, if you'r planning to use bots in VK.com, be aware, big brother is watching you :)

How can we login into VK.com ? I'ts not that hard, but it has some tricky steps.

1. Firstly we need to send GET request to http://m.vk.com and get "ip_h" parameter (it will be needed later)

$curl = curl_init();
$options = [
    CURLOPT_USERAGENT => 'Mozilla/5.0 (Windows NT 6.1; rv:26.0) Gecko/20100101 Firefox/26.0', // You can use any other user agent
    CURLOPT_URL => 'http://m.vk.com',
    CURLOPT_RETURNTRANSFER => 1,
    CURLOPT_TIMEOUT => 30
];

curl_setopt_array($curl, $options);
$response = curl_exec($curl);

preg_match('/ip\_h\=(.*?)\&/is', $response, $match);

$ip_h = $match[1];

2. Next, using ip_h parameter, we need to create next url for POST request to vk.com. This request if needed to get the link for actual authentication.

$data = [
    'email' => 'Your vk.com login or email',
    'password' => 'Your vk.com password'
];

$url = 'https://login.vk.com/?act=login&_origin=http://m.vk.com&ip_h='.$ip_h.'&role=pda&utf8=1';

$options = [
    CURLOPT_USERAGENT => 'Mozilla/5.0 (Windows NT 6.1; rv:26.0) Gecko/20100101 Firefox/26.0',
    CURLOPT_URL => $url,
    CURLOPT_POSTFIELDS => http_build_query($data),
    CURLOPT_POST => 1,
    CURLOPT_RETURNTRANSFER => 1,
    CURLOPT_HEADER => 1,
    CURLOPT_SSL_VERIFYPEER => 0,
    CURLOPT_SSL_VERIFYHOST => 0,
    CURLOPT_TIMEOUT => 30,
    CURLOPT_COOKIEFILE => 'Path to cookie.txt file', // You can create this file wherever you want. As for me, it was in the same folder as script
    CURLOPT_COOKIEJAR => 'Path to cookie.txt file',
];

curl_setopt_array($curl, $options);
$response = curl_exec($curl);

3. Now we need to parse a little response from the last request, and get from there URL, so we can finally log into the system and make some dirty things

// Getting our login URL
preg_match('/Location: (.*?)\n/is', $response, $match);

// Removing all whitespaces
$url = trim($match[1]);

// Sending request and now we must be logged in
$options = [
    CURLOPT_USERAGENT => 'Mozilla/5.0 (Windows NT 6.1; rv:26.0) Gecko/20100101 Firefox/26.0',
    CURLOPT_URL => $url,
    CURLOPT_RETURNTRANSFER => 1,
    CURLOPT_HEADER => 1,
    CURLOPT_TIMEOUT => 30,
    CURLOPT_COOKIEFILE => 'Path to cookie.txt file',
    CURLOPT_COOKIEJAR => 'Path to cookie.txt file'
];

curl_setopt_array($curl, $options);
curl_exec($curl);

// Closing CURL
curl_close($curl);

This is it :) Now you can send some request, that requires authorization (e.g. add likes to photos, join groups and so on)