lukinagin Posted January 9, 2008 Share Posted January 9, 2008 One of our developers has brought an interesting problem to my attention. I'll start off by describing our environment. We are running a Solaris 10 server with Apache 2.2.6. PHP version 5.2.5 is loaded as a module and appears to be working fine. However, our developer ran into a problem using dokuwiki. When he submits a form with a <html> tag in it, he receives a 400 error. He threw together this little script to verify the problem: <html> <body> <?php echo sprintf("%s", $_POST['wikitext']); ?> <br /> <form method="post" action="<?=$_SERVER['PHP_SELF']?>" accept-charset="utf-8"> <textarea name="wikitext" style="height: 300px;" cols="80" rows="10"></textarea> <input type="submit"/> </form> </body> </html> This can be viewed here: http://eagles.its.csulb.edu/php/PostTest.php As you can see, the script does nothing more than take what is submitted and display it on the screen. However, if you type in <html> then click on the Submit Query button, you will get a 400 error. Does anyone know why this is occurring? Am I looking at some php.ini parameter change to fix this? Quote Link to comment https://forums.phpfreaks.com/topic/85269-interesting-post-error/ Share on other sites More sharing options...
marklarah Posted January 9, 2008 Share Posted January 9, 2008 either you could be having two <html> tags, or its the code hang on. Quote Link to comment https://forums.phpfreaks.com/topic/85269-interesting-post-error/#findComment-435047 Share on other sites More sharing options...
marklarah Posted January 9, 2008 Share Posted January 9, 2008 try omitting <html> from the source Quote Link to comment https://forums.phpfreaks.com/topic/85269-interesting-post-error/#findComment-435048 Share on other sites More sharing options...
kenrbnsn Posted January 10, 2008 Share Posted January 10, 2008 You probably want to strip HTML tags from the input before displaying it. Use the striptags() function. You could also use the htmlentities() function to turn the characters "<" and ">" into "<" and ">" so the browser won't interpret the output as HTML. In any case, you should never just display input from a user without cleaning it of possibly harmful stuff. Ken Quote Link to comment https://forums.phpfreaks.com/topic/85269-interesting-post-error/#findComment-435099 Share on other sites More sharing options...
lukinagin Posted January 10, 2008 Author Share Posted January 10, 2008 Still no luck. Removing the <html> tags from the code: <body> <?php echo sprintf("<xmp>%s</xmp>", $_POST['wikitext']); ?> <br /> <form method="post" action="<?=$_SERVER['PHP_SELF']?>" accept-charset="utf-8"> <textarea name="wikitext" style="height: 300px;" cols="80" rows="10"></textarea> <input type="submit"/> </form> </body> Results in the same error when submitting <html>. I then tried using the htmlentities function: <html> <body> <?php echo htmlentities(sprintf("<xmp>%s</xmp>", $_POST['wikitext'])); ?> <br /> <form method="post" action="<?=$_SERVER['PHP_SELF']?>" accept-charset="utf-8"> <textarea name="wikitext" style="height: 300px;" cols="80" rows="10"></textarea> <input type="submit"/> </form> </body> </html> Again, same error when I submit <html>. To make things even more interesting, when I run this code against another server that is running PHP v4, it works. Only the machine running PHP v5 generates the 400 error. Quote Link to comment https://forums.phpfreaks.com/topic/85269-interesting-post-error/#findComment-435670 Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.