WAMP forbidden 403 error

[Ciannaky]

Not sure if this is the right forum for this question and apologize in advance if it isn't ...

 

I'm new to PHP and MySQL and have been developing a CMS  using WAMP5 and am having trouble inputing data from my form into the Database; I have no problem retrieving data from the table though.

 

I removed all passwords and set full permissions in phpmyadmin...In windows I gave the folder, subfolders and all files full permissions but when I submit the form i get:

 

Forbidden You don't have permission to access [directory/admin/contribs/<] on this server.

 

I saw (but now cannot find) a thread that referred to the use of $_SERVER['PHP_SELF'] as the forms action causing an issue.

 

any suggestions!?!?! I'm stuck.

 

 

Here's the code:

 

 

<?php

 

if (isset($_POST['submit'])):

 

$cnx = mysql_connect ('localhost','root','********');

mysql_select_db ('ciannaky');

 

$firstname = $_POST['firstname'];

$lastname = $_POST['lastname'];

$email = $_POST['email'];

//

 

$sql = "INSERT INTO contribs SET

FirstName='$firstname',

LastName='$lastname',

Email='$email'";

 

 

 

if (@mysql_query($sql)) {

echo ('<p>New contributor added</p>');

} else {

echo ('<p>Error adding new contributor: ' .

mysql_error() . '</p>');

}

 

?>

 

<p><a href="<?=$_SERVER['PHP_SELF']?>">Add another Contributor</a></p>

<p><a href="admin/contributors.php">Return to Contributors List</a></p>

 

<?php

else:

?>

 

<div id="stylized" class="myform">

<form action="<?$_SERVER['PHP_SELF']?>" method="post">

<fieldset>Add Contributor</fieldset>

<legend>* Required</legend>

 

<label>First Name</label><input type="text" name="FirstName" size="20" maxlength="255" /><br />

<label>Last Name</label><input type="text" name="LastName" size="20" maxlength="255" /><br />

<label>Email</label><input type="text" name="Email" size="20" maxlength="255" /><br /><br />

<input type="submit" name="submit" value="SUBMIT" /></p>

</form>

</div>

 

<?php endif; ?>

[Ciannaky]

Figured it out and thought I would share the answer in case needed.

 

changed <?=$_SERVER['PHP_SELF']?>

 

to <?php echo $_SERVER['PHP_SELF']?>

 

worked like a charm...

[Pikachu2000]

In any event, using that as a form action is a bad idea. It presents a known XSS vulnerability. To submit a form to itself, use action="" or name the script explicitly.

[Ciannaky]

thanks  for the warning...like I said...ima total noob!!! 

[Pikachu2000]

No problem. Unfortunately there are a ton of tutorials out there, and even some books that show that method even though it shouldn't really be used.