Posted by Charles Stuart on 10/10/05 23:42

Hi,

I'm on shared hosting. Because of security concerns on their part
[1], every time the text "curl u" is inputted, a 403 forbidden is
given and the form is not submitted. This is of course a problem as
I'm doing work for a children's literacy program, and plenty of
people try to input "curl up with a book".

I'm trying to use 'str_replace' to solve this issue, but I can't seem
to get around the 403 error.

It appears as if the hosting service doesn't give me a chance to
replace "curl u" with something else prior to them blocking the
attempted submit.

I can tell my str_replace is working as if I change the searched text
to something other than "curl u" it does in fact replace it and
submit it correctly.

Anyone have any ideas for a workaround? My next thought is to use
javascript, but I think the site serves quite a few people who might
not have javascript on.

Thanks for listening. Below is the PHP [2].


best,

Charles


[2]
// Grabbing the data from the form.

if ($task == "updateInfo")
{
$activityChallenges = cs_remove_curl_up(sanitize_paranoid_string
($_POST["activityChallenges"]));
}



// change "curl u" to "EDIT kurl u"

function cs_remove_curl_up($string, $min='', $max='')
{
$string = str_replace("curl u", "EDIT kurl u", $string);
$len = strlen($string);
if((($min != '') && ($len < $min)) || (($max != '') && ($len >
$max)))
return FALSE;
return $string;
}



[1]
My host told me this:

"Mod_security is restricting this and blocks all url's with C-url.
This is done because of some php worms that are spread using c-url. I
would recommend trying to work around this. It will be a major
security issue for us to allow this."

[Back to original message]