403 forbidden

[NiceCupOfTea]

Just had this error posting a new thread.

After reading this thread and a bit of guesswork I realised it didn't like the word "delete" so I had to post it as "dlete" instead

What is it, amateur hour!?

[dhutch]

NiceCupOfTea said:

Just....

What is it, amateur hour!?

Mmmm

I'm sure it's not a 2min fix, but you would have thought it would be sorted by now eh!

[98elise]

NiceCupOfTea said:

Just had this error posting a new thread.

After reading this thread and a bit of guesswork I realised it didn't like the word "delete" so I had to post it as "dlete" instead

What is it, amateur hour!?

Its likely to be delete + something else used in SQL in the same line.

Edited to add, this post was fine, so "delete" on it's own doesn't trigger it

Edited by 98elise on Friday 28th April 09:40

[jammy-git]

98elise said:

NiceCupOfTea said:

Just had this error posting a new thread.

After reading this thread and a bit of guesswork I realised it didn't like the word "delete" so I had to post it as "dlete" instead

What is it, amateur hour!?

Its likely to be delete + something else used in SQL in the same line.

Edited to add, this post was fine, so "delete" on it's own doesn't trigger it

Edited by 98elise on Friday 28th April 09:40

The stupid thing is, NO other site I use has this issue. Just properly escape the text input and then you don't need to worry about SQL injection. It's like lesson 1 in secure web development!!

[98elise]

jammy-git said:

98elise said:

NiceCupOfTea said:

Just had this error posting a new thread.

After reading this thread and a bit of guesswork I realised it didn't like the word "delete" so I had to post it as "dlete" instead

What is it, amateur hour!?

Its likely to be delete + something else used in SQL in the same line.

Edited to add, this post was fine, so "delete" on it's own doesn't trigger it

Edited by 98elise on Friday 28th April 09:40

The stupid thing is, NO other site I use has this issue. Just properly escape the text input and then you don't need to worry about SQL injection. It's like lesson 1 in secure web development!!

Agreed, but it explains why it's happening even if it shouldn't be happening.

[NiceCupOfTea]

98elise said:

NiceCupOfTea said:

Just had this error posting a new thread.

After reading this thread and a bit of guesswork I realised it didn't like the word "delete" so I had to post it as "dlete" instead

What is it, amateur hour!?

Its likely to be delete + something else used in SQL in the same line.

Edited to add, this post was fine, so "delete" on it's own doesn't trigger it

Edited by 98elise on Friday 28th April 09:40

Yes, I got rid of all quotes and brackets, and looked for s(e)lect....from - whilst that wasn't there I noticed there was d(e)lete....from and surmised (not knowing anything about SQL) that that might also trigger it. Hey presto!

[and obviously I got a 403 forbidden when I posted this so had to had some brackets!)

[98elise]

NiceCupOfTea said:

98elise said:

NiceCupOfTea said:

Just had this error posting a new thread.

After reading this thread and a bit of guesswork I realised it didn't like the word "delete" so I had to post it as "dlete" instead

What is it, amateur hour!?

Its likely to be delete + something else used in SQL in the same line.

Edited to add, this post was fine, so "delete" on it's own doesn't trigger it

Edited by 98elise on Friday 28th April 09:40

Yes, I got rid of all quotes and brackets, and looked for s(e)lect....from - whilst that wasn't there I noticed there was d(e)lete....from and surmised (not knowing anything about SQL) that that might also trigger it. Hey presto!

[and obviously I got a 403 forbidden when I posted this so had to had some brackets!)

SQL is used to filter and manipulate data so words like...

Select
Insert
Update
Delete
Truncate
Add
Create
Etc

...are all valid SQL commands.

[TonyRPH]

I suspect that some serious exploits have been found in the forum code, and this is their solution to circumvent any exploits.

I recall some years ago (must be about 12 years ago!) that some astute PHer(s) found some pretty bad exploits and reported it back then.

Maybe those have long since been fixed and maybe others have been found....

[dhutch]

I'm sure the forum code is well behind what it now should be, behind the scenes as well as in terms of user interface.

I guess the issue is, how much time and money do you invest in that that? For what return? Especially due to the integration with articles on the wider site which mean an off the shelf solution wouldn't be instantly plug and play.

Equally, what is a website without a website, and the forum is a large part of what draws people in and keeps them here.

[Condi]

I see there are 2 or 3 new threads about this problem....

Any closer to a fix, PH devs?

[deadtom]

I've just started getting 403 errors when trying to reply to the Cardiff crash thread (https://www.pistonheads.com/gassing/topic.asp?h=0&f=205&t=2036191&i=0). It happens both when posting new reply and when trying to quote someone.

[Fonzey]

Heh. Just ran into this myself trying to update a post with the word "Delete"

[Countdown]

me too

[r3g]

98elise said:

SQL is used to filter and manipulate data so words like...

Select
Insert
Update
Delete
Truncate
Add
Create
Etc

...are all valid SQL commands.

This is quite interesting. I have just fallen foul of this myself with this reply :

"180??!!

OFF WITH HIS HEAD!

<insertdefault "you should have set off earlier" comment here>

<insert detault whataboutery "what if a small child ran out into the road" comment here>"

I get 403 if I put the proper space between 'insert' and 'default'. It will only post if I remove the space so it's no longer 'insert' on its own. However it works ok with the other sentence.

[768]

I'm getting 500s everywhere now. Can't get to website feedback to post a new thread.

[thegreenhell]

Same here - 500 error in every sub forum. I can only get to individual threads through My Stuff.

[Countdown]

MeToo

[Monkeylegend]

Glad it's not just me then,

I can only get into threads that are already in My Stuff, everything else is an oops 403 forbidden.

[Condi]

Business as usual then


But have you noticed the new PH logo at the top of the page?

[WyrleyD]

Just happened to me too. Tracked it down to the word "SELECT" in mid sentence so changed it to "CHOOSE" and it went in OK. I know that "SELECT" is a SQL instruction so guess that's why it objected to it.