PHP/MySQL - "and"后跟表格上的数值，给出 403 Forbidden

Question

我遇到了一个小问题。

我有一个表单可以将数据提交到数据库。直到今天发现一个我无法理解的小错误之前，一切都运行良好。

如果我输入单词“and”后跟一个数字字符(例如:“and 10”)，我会收到 403 forbidden 错误提示

You don't have permission to access /index.php on this server.

Additionally, a 403 Forbidden error was encountered while trying to use an >ErrorDocument to handle the request.

我在表单输入上进行了清理，这是清理的功能

function make_safe($variable) {
    $variable = mysql_real_escape_string(trim($variable));
    return $variable;
}

我已经尝试过清洁和不清洁。任何人对可能导致此错误的原因有任何想法吗？我实际上无法从错误日志中获取任何内容，因为那里没有任何内容..

编辑:完整代码如下(请注意这是一个非常古老的项目，已经运行多年，这个错误才刚刚被发现!)

<?php
checksecurity(ABSENCE_ADD);

if(isset($_POST['submit'])) {
$todate = make_safe($_POST['dateto']);
$fromdate = make_safe($_POST['datefrom']);
$reason = make_safe($_POST['reason']);
$comments = make_safe($_POST['comments']);
$date1 = str_replace("/","-",$fromdate);
$newDate1 = date("Y-m-d", strtotime($date1));
$date2 = str_replace("/","-",$todate);
$newDate2 = date("Y-m-d", strtotime($date2));
$username = $_SESSION['username'];
$query_user = mysql_query("SELECT * FROM users WHERE username='{$_SESSION['username']}'");
while($row = mysql_fetch_array($query_user)) {
$userid = $row['id'];
if(empty($todate) || empty($fromdate) || empty($reason)) {
    echo' You left out a field';
} else {
$query = "INSERT INTO `absences` (`id`, `fromdate`, `todate`, `reason`, `comments`, `username`, `userid` ) VALUES (NULL, '" . $newDate1 . "', '" . $newDate2 . "', '" . $reason . "', '" . $comments . "', '" . $username . "', '" . $userid . "')";
$hello = mysql_query($query) or die(mysql_error());
print $query;
                        } 

}                       
} else {
?>
<form id="form" name="form" method="post" action="#">
<table width="820" border="0" cellspacing="0" cellpadding="0" class="content">
  <thead>
<tr>
    <th width="820" colspan="4"><strong>Request Absence</strong></th>
  </tr>
</thead>
<tr>
<td>From (dd/mm/yyyy)</td>
<td><input name="datefrom" class="tcal"/></td>
<td>To (dd/mm/yyyy)</td>
<td><input name="dateto" class="tcal" /></td>
</tr>
<tr>
<td>Reason</td>
<td><select name="reason"> 
    <option value="Illness/Injury">Illness/Injury</option>  
    <option value="Holiday">Holiday</option>
    <option value="Family Engagement">Family Engagement</option>
    <option value="School or College Commitment">School or College Commitment</option>
<option value="Employment Commitment">Employment Commitment</option>
<option value="Other">Other</option>
</select> </td>
<td>Comments</td>
<td><input name="comments" type="text" /></td>
</tr>
</table><br />
<input type="submit" name="submit" value="Add" /> <input type="reset" name="reset" value="Reset" /> 
</form>
<?
}


?>

Answer 1

您的代码是否发出过此错误消息？它与 Apache 返回的默认错误消息的措辞完全相同。我怀疑您在这里看到了 Apache 错误消息 - 在这种情况下，请求永远不会到达您的 PHP 代码。如果是这样，那么这里的问题就离题了。

最可能的原因是您配置了一个非常狂热的 WAF(mod_security？)，它会将您的请求误认为是 SQL 注入(inject)攻击。