Question

I’ve got a problem with a form in the administration area of my website. I use it for changing the displayed HTML text, it is written in PHP and connects to a MySQL database.

echo "<form action=\"index.php?kat=infos&aktion=upd&kategorie=$kategorie\" method=\"POST\" enctype=\"application/x-www-form-urlencoded\">\n";
echo "<table border=\"0\">\n";
echo "<b>$kategorie</b>\n";
echo "<tr><td><b>Information:</b></td><td><textarea name=\"info\" cols=\"50\" rows=\"7\">$info</textarea></td></tr>\n";
echo "<tr><td><input type=\"submit\" value=\"Editieren\" /></td></tr>\n";
echo "</table>\n";
echo "</form>\n";

If i enter some small sentences like “This is a test text only.” and click the submit-button, the index.php accepts the data and inserts it into the database just as it should. But if I enter a longer text like the disclaimer from http://www.juraforum.de/disclaimer_muster/ I get a Error 403 on form submit.
I do not think it is because of the longer text, because if I write some longer random text in there it works, too.

I hope you can help me with this one.

Answer 1

The 403 Status Code means:

10.4.4 403 Forbidden

The server understood the request, but
is refusing to fulfill it.
Authorization will not help and the
request SHOULD NOT be repeated. If the
request method was not HEAD and the
server wishes to make public why the
request has not been fulfilled, it
SHOULD describe the reason for the
refusal in the entity. If the server
does not wish to make this information
available to the client, the status
code 404 (Not Found) can be used
instead.

The disclaimer seems to contain several HTML tags and they apparently get printed unescaped on the page.

My wild guess is that there’s a piece of software installed on the server (possibly mod_security) that rejects the input because it considers it’s an attempt to perform a XSS attack. You can confirm (or reject) this hypothesis by temporarily removing the < and > symbols before pasting it into the textarea.