Forbidden

Awestruck

Please would you advise me whether I have struck a MIME type problem on my remote host, I use a paid-for host and the web site works fine except for the function strpos in a PHP feed-back form handler. To test a filter, I enter a URL in a form field that is filtered with strpos to prevent URL entries. I get this error message when I click the submit button:
ForbiddenYou don't have permission to access /form-handler.php on this server.
Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request
This occurs even if I set the file handler to CHMOD 777.

The contents of the hosts error log read as follows:-
25-May-2012 12:41:09] PHP Warning: PHP Startup: Unable to load dynamic library '/usr/local/lib/php/extensions/no-debug-non-zts-20060613/suhosin.so' - /usr/local/lib/php/extensions/no-debug-non-zts-20060613/suhosin.so: cannot open shared object file: No such file or directory in Unknown on line 0

The file suggesterror.html is definitely present in the directory. The bits of PHP that cause this error message are:-

$suggestion = $_POST['suggestion'] ;
...
$errorsuggesturl = "suggesterror.html" ;
...
//check that no urls have been inserted in the suggestion text area
if (strpos ($suggestion, '://')||strpos($suggestion, 'www') !==false){
header( "Location: $errorsuggesturl" );
exit ;
}

I hope you can help me solve this mystery

Regards

Awestruck

dagon

i would ask your host about the error in the log as that's an issue with the set-up at their end.

Awestruck

Thank you Dagon for the prompt reply.

I contacted the host on the 25th and am awaiting a reply.

Meanwhile can you see anything wrong in my code or the methodology?

The purpose, as you probably guessed, is to stop computer generated replies from inserting dodgy URLs in the form fields. This is a common problem and it annoyed my clients intensely. The code works with some hosts but with others it shows the Forbidden message.

Regards

Awestruck

traq

Your check won't stop people from entering URLs like [font=monospace]hey guys, visit my site at example.com![/font] - not to mention URLs like [font=monospace]example [dot] com [/font], which many spammers are used to doing anyway. I would also be concerned about cases where "www" legitimately appears in text, outside of URLs.

Awestruck

Thank you traq
You are absolutely right, but so far (in 12 years) no robot or hacker has tried either of those ploys. However, I would like to be prepared for the day it does happen. Any suggestions for detecting when a URl or partial URL has been inserted in the contact form so that it can produce an error message page. Incidentally, none of my clients like Captcha, pity because it would be an extra safguard. I still have no reply from the host about the Forbidden message when using strpos.
Regards
Awestruck

traq

captchas aren't the "end-all" solution most people think they are. I place them in the same category as no-right-click scripts: problematic for honest users, trivial for malicious users. I have a captcha on one of my sites' contact pages; my email filter catches more bot-spam than the captcha does.

If you're targeting bots rather than URLs in general, you might look into some other approaches: honeypots, nonce access tokens, submission time-outs, and so forth.

Regarding your "Forbidden" problems: as dagon said, this isn't (directly) an issue with using [font=monospace]strpos()[/font]. Your host is having trouble with their PHP configuration (suhosin is software designed to protect PHP installs on shared hosting from malicious users - your scripts might be revealing the problem, but they certainly aren't causing the problem). I would expect your host to be taking this issue very, very seriously once you reported it. Keep bugging them.

dagon

had nothing but issues with suhosin, got the serve guy to remove it, if i was you I would ask my host to keep it off my account.

traq

I've never had to deal with it. But, it's got to be fixed - "removing" being a possible form of fixing. 🙂

Awestruck

Hello folks
your replies have been most informative. The host's error log refers to "huosin" so that is probably the reason for the Forbidden notice. As some host's use this software, I need to post a universal solution on the page for my recent book Practical HTML5 Projects (Apress). I need code that will remove or santitize URLs entered into a PHP contact form handler, a solution that would be acceptable to any host. Your suggestions would be most welcome.
Best wishes
Awestruck

traq

If you look more closely at that error message, you'll notice that the problem isn't with something suhosin does, it's that some of the suhoshin scripts are missing.

This is configuration problem -one that is out of your control as a user- and not something that should be expected under normal circumstances.

Awestruck

Many thanks I will use that to kick the host's butt and get some action.
Regards
Awestruck