Home/ Questions/Q 6825807
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-26T22:04:30+00:00

I’m creating a form where the user should be able to enter any text

  • 0

I’m creating a form where the user should be able to enter any text (used to change articles on the site), Html, JavaScript or literally anything is allowed to type in and post, and so far everything worked. But today I suddenly got this strange error.

When I try to save text with Html to a MySQL database like this:

<a href="http://www.google.com/">google</a>

nothing goes wrong, but when I try it like this:

<img src="http://www.google.com/" />

The page does not load (forbidden error) and the database does not contain any of the text is should contain (the Html).

Instead the page shows the following error:

Forbidden
You do not have permission to access this document.

The same problem occurs when I try to post the following data:

src="http:

Why do I get a forbidden error when the post contains that specific piece of text, whats going on here?

Code I’m using:

if($_SERVER['REQUEST_METHOD']=="POST" && !empty($_POST['save'])){
    $text = mysql_real_escape_string($_POST['textarea']);
    $title = mysql_real_escape_string($_POST['title']);
    $query = "INSERT INTO articles (text, title) VALUES ('".$text."','".$title."')";

When I remove the MySQL query I still get the error so it has nothing to do with the database. PHP safe mode is on, could that make a difference?

How can this be fixed?

Edit: Tried the complete application on my xampp server and it did not show the error, but on my hosting server I use the script in a password protected map. could that be the problem? Anyway I’m going to contact my hosting company.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    It sounds a bit like mod_security, switched on and in its most aggressive mode, and it thinks you’re trying to hack the site. The reason I say it only sounds a bit like that is because no-one should normally configure it to check POST data because that causes far too many false positives. But check the error log(s) as it will probably be listed there if it’s that. If so you’ll need to turn it off in the hosting settings or nag your host to do it.

    Also try a bare minimum script: <?php var_dump($GLOBALS); ?> to see if the data reaches PHP at all.

    • 0