[RESOLVED] Form generates a 403 error

robkir

I have a form that presents the user with an array. There are three hidden types in the form, plus a checkbox. When the form is submitted, it generates a 403 error. Here's the kicker. If I remove one of the hidden types, the form works and it doesn't matter which of the 3 that I remove. Any ideas?

echo "<tr>
<td>
	<input type='hidden' name='thisTenant[".$row['tenant_ID']."]' value='".$row['tenant_ID']."'>
	<input type='hidden' name='schedule_rent_array[".$row['tenant_ID']."]' value='".$row['schedule_rent']."'>
	<input type='hidden' name='deposit_log_array[".$row['tenant_ID']."]' value='".$row['deposit_log_numb']."'>
	<input type='checkbox' name='checkBox_array[".$row['tenant_ID']."]' $checkBoxStatus>$rentStatus ".$row['rent_paid']."</td>
	<td>" .$row['unit_number'] . "</td>
	<td>" .$row['last_name'] . ", " .$row['first_name'] . " ID" . $row['tenant_ID'] . "</td>
	<td>$" .$row['scheduled_rent'] . "</td>
	<td>$update_deposit_log_numb</td>
	<td>" .$row['comment'] . "</td>
</tr>";

}

The form data is gathered from three tables using a LEFT JOIN. Not sure if that might affect it...?

Thanks,
Robkir

Weedpacket

Not knowing anything about your system (for all I know it may be Suhosin, for example, which has a limit on the number of variables allowed in a POST request) I'm going to guess that there is some attempt being made to prevent the server from being vulnerable to attack by wacky form submissions.

Is it really necessary for the server to send all that information to the client just so the client can send it back to the server (hopefully unaltered)? Doesn't the server already have that information?

robkir

Hi Weedpacket,

Yep, the server does have that information. I was using the JOIN / hidden to expedite gathering the data, but I could pull it off the server after the submit. Thanks for the input.

NogDog

Or store it in $_SESSION?

robkir

Hi MonDog,
Another good idea. Thanks.

I'm still curious as to why it happened, I sent a query to the host to see if they knew. Fortunately I have enough work arounds that its no longer an issue.

Cheers,
Bob

robkir

I heard back from tech support and WeedPacket had the right answer. The form was triggering mod_security rules.

Fortunately, it all works now.

robkir