Trying to pass the word "curl" in a form

blakenzoe

Don't know if this is a PHP issue or an Apache issue...sorry in advance if it's Apache.

I have an address form in one of my php scripts. A user is trying to set his address to the legitimate address "123 Floyd Curl St." but whenever he tries to submit the form, Apache throws up a "503 -- Service Temporarily Unavailable" and the error log reads:

Access Denied: "curl\x20"@post_payload

Apparently the server thinks the user is trying to actually execute the curl command.

How do I get the word "curl" to be accepted in the form post?

Thanks in advance,
Blakenzoe

thorpe

this should never happen unless your executing (using eval) incomming strings which would be a BIG no no.

post your code that excepts and validates these form variables.

blakenzoe

I'm definitely not using the eval command anywhere in my code. In fact, it appears that my form post is never even making it to the validation page. I just tried changing my <form> tag to read:

When I submitted the page, I never got a 404 error -- I just got the same 503 error.

I think Apache is intercepting the HTTP post and throwing the error, before Apache forwards the post to my PHP.

thorpe

yeah... didnt think anyone would be that silly. :-P

well, its got me stumped. anyone???

Weedpacket

Any other PHP scripts do the same thing - in the same directory or other directories?

Sounds like either a bad installation or (somewhat more likely) Apache has been configured (a <Limit> or <LimitExcept> clause in httpd.config or .htaccess) to refuse POST requests. That would get you a 503 response.

blakenzoe

After calling the weekend warriors at my ISP and having them look at log files, it looks like the mod_security Apache module is the culprit; it apparently has a pattern match rule set up to trap the word "curl" in any HTTP posts, and then spit out a 503 error each time. Hopefully they'll be able to take care of this for me on Monday.