doumou3883 2015-09-01 12:11
浏览 27

POST输入重定向页面中的某些文本?

I've got a simple form with a textarea that simply takes the contents and stores it in the database. Text of all sorts can be entered, including HTML, without any issue with the following exception:

and selecting Sign Up from the main menu.

That line of text results in the URI (in this case it is like the following):

index.php?pg=create

To being rewritten to simply:

?pg=create

How in the world is POST data manipulating the URL? In some cases, entering that exact same line of text above will result in being redirected to an entirely different web page on the site. Why the inconsistent results?

I've tried removing any code that grabs the POST values to store them, and the same results are experienced, but only when the above line of text is entered. (Whether it is pasted or typed in manually.)

I've never had such a weird issue before and would greatly appreciate any help.

Note: the system is running CentOS, Apache, MySQL, PHP - the website is an application run in a sub-directory with the root of the site being Wordpress. ALSO: my testing server is nearly identical, running the same code, but the OS is Ubuntu, and I haven't experienced the issue on the testing server.

I should add that yes I am using prepared statements. (Seeing that the text mentioned looks like it could be executed in MySQL)

Here is the code of the page that gets posted to:

if (isset($_POST['submit_add_customer_note'])) {
    $num_special_notes = number_of_customer_notes($current_user_id);
    $valid_limit = false;

    if ($num_special_notes < MAX_LIMIT_SPECIAL_NOTES) {
        $valid_limit = true;
    }

    if ($valid_limit) {
        if ($_POST['special_note'] != '' && $_POST['special_note_desc'] != '') {
            $special_note = substr(trim($_POST['special_note']), 0, 5000);
            $special_note_desc = substr(trim($_POST['special_note_desc']), 0, 100);

            if (insert_new_customer_note($current_user_id, $special_note, $special_note_desc)) {
                header('Location: index.php?pg=manage_customer_notes&status=success');
                exit;
            } else {
                echo DB_ERROR;
            }
        } else {
            header('Location: index.php?pg=add_customer_note&status=not-filled-out');
            exit;
        }
    } else {
        header('Location: index.php?pg=manage_customer_notes&status=limit-reached');
        exit;
    }
}

And here is the code for insert_new_customer_note:

function insert_new_customer_note($u_id, $special_note, $special_note_desc) {
    $db = new mysql_conn();

    $stmt = $db->prepare("INSERT INTO customer_special_notes (user_id, description, message)
                          VALUES(?, ?, ?)");

    $stmt->bind_param('iss', $u_id, $special_note_desc, $special_note);

    if (!$stmt->execute()) return false;

    $stmt->close();
    $db->close();

    return true;
}

Thanks in advance!

  • 写回答

0条回答 默认 最新

    报告相同问题?

    悬赏问题

    • ¥15 虚幻5 UE美术毛发渲染
    • ¥15 CVRP 图论 物流运输优化
    • ¥15 Tableau online 嵌入ppt失败
    • ¥100 支付宝网页转账系统不识别账号
    • ¥15 基于单片机的靶位控制系统
    • ¥15 真我手机蓝牙传输进度消息被关闭了,怎么打开?(关键词-消息通知)
    • ¥15 装 pytorch 的时候出了好多问题,遇到这种情况怎么处理?
    • ¥20 IOS游览器某宝手机网页版自动立即购买JavaScript脚本
    • ¥15 手机接入宽带网线,如何释放宽带全部速度
    • ¥30 关于#r语言#的问题:如何对R语言中mfgarch包中构建的garch-midas模型进行样本内长期波动率预测和样本外长期波动率预测