Weird $_POST error

Blake121 · #1 (**permalink**) Jun 4th, 2007, 16:26

I have the strangest error appearing on my website.

I use PHP to process anything submitted through a form. Including my mail form and blog ones that insert into database tables.

They work just as normal when you type text into them but when you type HTML or anything between < > tags into them they just redirect you to the homepage. Even when I have no redirects set up on the page.

I've never seen this before. Plus my forms have been working for ages, My host has just moved servers though. Do you think they changed a configuration or something?

Has anyone got any ideas what's going on/how to fix it?

Thanks.

Accurax · #2 (**permalink**) Jun 4th, 2007, 19:28

can you post the offending script(s) maybe we can see the issue

Blake121 · #3 (**permalink**) Jun 4th, 2007, 21:31

Here's one. It inserts a blog post into a database table. The others are similar so I won't post them. Can you see anything at all in this that would cause the page to redirect to www.theloop.org.uk on post and not insert into the database?

Note this works completely fine if you don't put anything between < > tags in the fields.

PHP: Select all


<?php
if(array_key_exists('insert', $_POST)) {
    
    $connect = '../includes/connection.inc.php';
    if(file_exists($connect) && is_readable($connect)) {
        include($connect);
    }
    
    $corefuncs = '../includes/corefuncs.php';
    if(file_exists($corefuncs) && is_readable($corefuncs)) {
        include($corefuncs);
    }
    //remove backslashes
    nukeMagicQuotes();

    //prepare array of expected items.
    $expected = array('title', 'article');

    //create database connection
    $conn = dbConnect('admin');

    //make $_POST data safe
    foreach ($_POST as $key => $value) {
        if(in_array($key, $expected)) {
            ${$key} = mysql_real_escape_string($value);
        }
    }

    //prepare SQL
    $sql = "INSERT INTO blog (title, article, created) VALUES ('$title', '$article', NOW())";
    //process query
    $result = mysql_query($sql) or die(mysql_error());

    //if successful redirect to blog list
    if($result) {    
        header('Location: http://www.theloop.org.uk/admin/blog_list.php');
        exit;
    } else {
        $error = 'Error writing data to Database';
    }
    
}
?>    
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<title>Blog - Insert new record</title>
<link href="admin.css" rel="stylesheet" type="text/css" />
</head>

<body>
    <h1>Insert new blog entry </h1>
    <?php 
    if(isset($error)) {
       echo "<p class='warning'>$error</p>";
    }
    ?>
    <form id="form1" name="form1" method="post" action="">
        <p>
            <label for="title">Title:</label>
            <input name="title" type="text" class="widebox" id="title" />
        </p>
        <p>
            <label for="article">Article:</label>
            <textarea name="article" cols="60" rows="25" class="widebox" id="article"></textarea>
        </p>
        <p>
            <input type="submit" name="insert" value="Insert new entry" />
        </p>
    </form>
</body>
</html>

Plus I know its connecting to the database fine and nukeMagicQuotes() works fine. So it's not the includes.

I just can't figure it out. Any help would be great!

Blake121 · #4 (**permalink**) Jun 6th, 2007, 22:26

Any help? Anyone? Accurax?

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
[SOLVED] Strange error with $_POST	AdRock	PHP Forum	2	Oct 13th, 2007 17:12
$_POST Problem	Bradster	PHP Forum	3	May 30th, 2007 16:13
Use $_POST variables to transmit session id?	masonbarge	PHP Forum	9	May 8th, 2007 14:03
Weird IE bug?	spinal007	Web Page Design	15	Sep 7th, 2006 14:17
pass $_POST data into popup window	ktsirig	JavaScript Forum	1	Apr 19th, 2006 16:49

		Webforumz.com > Main Forums > Program Your Website > PHP Forum
Weird $_POST error