Help me for this strange error

vikaspa

I am puttting following code in text area (which is nothing but you-tube embed code

When submit is clicked
it gives error (image attached)

You dont have permission to acccess xxx.php
xxx.php is nothing but the program file

My insert script is as follow

$insert=sprintf("INSERT INTO youtube( id, status, srno, name, detail , code )
VALUES ('', %s, %s, %s, %s , %s )",
GetSQLValueString($POST["status"], "int"),

GetSQLValueString($POST["srno"], "int"),

GetSQLValueString(addslashes($POST["name"]), "text"),
GetSQLValueString(addslashes($POST["detail"]), "text"),
GetSQLValueString(addslashes($_POST["code"]), "text"));

which works (Inser quesry) alright
in case
i enter normal text like "abcd "
insted of

refer page for error

please help

bradgrafelman

For one, why are you using [man]addslashes/man on the POST'ed data? Not only should [man]addslashes/man never be used to sanitize data for SQL queries (it was never designed for such a purpose and simply isn't sufficient to use it as such), but you're already using a function which presumably handles the escaping itself.

Second, that error sounds like it's being generated by Apache (are you using Apache?) rather than PHP. As such, have you checked the webserver's error/access logs to see if anything pertinent is being logged? My guess is that you have some sort of "security" module installed/enabled that thinks it's doing you a favor by rejecting requests that contain certain input.

vikaspa

Dear All i was not using assslashes

but bacause of the error

I tried this .....

it has something to do with this embed code
since a plain text is well accepted without an error

if someone can help i will be thankful

bradgrafelman

vikaspa wrote:
Dear All i was not using assslashes

Um.. well that's great, but no one suggested you were. I did, however, point out that you were using addslashes(). And yes, it didn't have anything to do with the specific error you mentioned, but it was still wrong and I was nice enough to educate you nonetheless. Consider it a freebie.

vikaspa wrote:
if someone can help i will be thankful

Did you read the rest of my post above?