2010-01-19 08:21
浏览 629


I've got a problem with a form in the administration area of my website. I use it for changing the displayed HTML text, it is written in PHP and connects to a MySQL database.

echo "<form action=\"index.php?kat=infos&aktion=upd&kategorie=$kategorie\" method=\"POST\" enctype=\"application/x-www-form-urlencoded\">
echo "<table border=\"0\">
echo "<b>$kategorie</b>
echo "<tr><td><b>Information:</b></td><td><textarea name=\"info\" cols=\"50\" rows=\"7\">$info</textarea></td></tr>
echo "<tr><td><input type=\"submit\" value=\"Editieren\" /></td></tr>
echo "</table>
echo "</form>

If i enter some small sentences like "This is a test text only." and click the submit-button, the index.php accepts the data and inserts it into the database just as it should. But if I enter a longer text like the disclaimer from http://www.juraforum.de/disclaimer_muster/ I get a Error 403 on form submit. I do not think it is because of the longer text, because if I write some longer random text in there it works, too.

I hope you can help me with this one.

  • 点赞
  • 写回答
  • 关注问题
  • 收藏
  • 邀请回答

7条回答 默认 最新

  • douling0053 2010-01-19 08:48

    The 403 Status Code means:

    10.4.4 403 Forbidden

    The server understood the request, but is refusing to fulfill it. Authorization will not help and the request SHOULD NOT be repeated. If the request method was not HEAD and the server wishes to make public why the request has not been fulfilled, it SHOULD describe the reason for the refusal in the entity. If the server does not wish to make this information available to the client, the status code 404 (Not Found) can be used instead.

    The disclaimer seems to contain several HTML tags and they apparently get printed unescaped on the page.

    My wild guess is that there's a piece of software installed on the server (possibly mod_security) that rejects the input because it considers it's an attempt to perform a XSS attack. You can confirm (or reject) this hypothesis by temporarily removing the < and > symbols before pasting it into the textarea.

    点赞 打赏 评论
  • dongma1666 2010-01-19 15:29

    Here's the solution that works for me:

    Apparently mod_security did not like that the name of the textarea was "info". After changing it to "text" there were no more problems and I can now enter any text I want.

    Thank you for your help

    点赞 打赏 评论
  • dongyanfeng0546 2011-02-03 22:18

    Had the same problem. Changing the name of the textarea from "info" to something else seemed to work.

    点赞 打赏 评论
  • dongmi5177 2012-09-29 12:26

    You will get this issue when you submit a form with a url. posting urls might be blocked in server for security reasons.

    点赞 打赏 评论
  • dongzi0850 2015-05-22 15:02

    Just adding to this to say that I also had this problem and it turned out to be a mod_security rule that false-positived, that caused the problem. The host of the site was able to whitelist the domain against the particular rule. The rule was apparently 211580 - "COMODO WAF: SQL Injection Attack".

    点赞 打赏 评论
  • duanmao2774 2015-08-24 13:14

    I was also suffering with this problem, until I worked out that having a combination of HTML tags and slashes in a <textarea> field caused it. This was also code that was to be inserted into a database.

    I was already using mysqli_real_escape_string(), but that didn't seem to make a difference.

    点赞 打赏 评论
  • douyu5775 2019-05-10 05:54
    $text = '<p>Test paragraph.</p><!-- Comment --> <a href="#fragment">Other text</a>';
    echo strip_tags($text);
    echo "
    // Allow <p> and <a>
    echo strip_tags($text, '<p><a>');


    1.Use [strip_tags()][2]
    2.Use [HTML Purifier][1] (recommended)
    点赞 打赏 评论

相关推荐 更多相似问题