Member Avatar for Eko

The following cod,when I press the SUBMIT button , I get "Forbidden, You don't have permission to access /< on this server."

<html>
<head>
<title> The Internet Joke Database </title>
</head>
<body>
<?php
  if (isset($_GET['addjoke'])): // If the user wants to add a joke
?>

<form action="<?=$_SERVER['PHP_SELF']?>" method="post">
<p>Type your joke here:<br />
<textarea name="joketext" rows="10" cols="40" wrap>
</textarea><br />
<input type="submit" name="submitjoke" value="SUBMIT" />
</p>
</form>
<?php
  else: // Default page display

    // Connect to the database server
    $dbcnx = @mysql_connect('localhost', 'root', 'mypasswd');
    if (!$dbcnx) {
      die( '<p>Unable to connect to the ' .
           'database server at this time.</p>' );
    }

    // Select the jokes database
    if (! @mysql_select_db('jokes') ) {
      die( '<p>Unable to locate the joke ' .
           'database at this time.</p>' );
    }

    // If a joke has been submitted,
    // add it to the database.
    if (isset($_POST['submitjoke'])) {
      $joketext = $_POST['joketext'];
      $sql = "INSERT INTO Jokes SET
              JokeText='$joketext',
              JokeDate=CURDATE()";
      if (@mysql_query($sql)) {
        echo('<p>Your joke has been added.</p>'); 
      } else {
        echo('<p>Error adding submitted joke: ' .
             mysql_error() . '</p>');
      }
    }

    echo('<p> Here are all the jokes in our database: </p>');

    // Request the text of all the jokes
    $result = @mysql_query('SELECT JokeText FROM Jokes');
    if (!$result) {
      die('<p>Error performing query: ' .
          mysql_error() . '</p>');
    }

    // Display the text of each joke in a paragraph
    while ( $row = mysql_fetch_array($result) ) {
      echo('<p>' . $row['JokeText'] . '</p>');
    }

    // When clicked, this link will load this page
    // with the joke submission form displayed.
    echo('<p><a href="' . $_SERVER['PHP_SELF'] .
         '?addjoke=1">Add a Joke!</a></p>');

  endif;

?>
</body>

</html>

The funny thing is that 2 month ago,the same code , on the same machine worked.
Now I tried on a different pc,I install/unistall dozens of wamp versions , I don't have a clue what could be wrong
As the code says,I'm running it on the same computer ( localhost )

  • 3 Contributors
  • 5 Replies
  • 127 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by Eko

Dani AI

Generated

As correctly diagnosed, the 403 came from using short PHP open tags in the form action while short_open_tag was turned off. When PHP does not parse <? ... ?> the raw characters are sent to the browser, leaving the form action as an invalid URL (which is why Apache served a “Forbidden” for a path like /<'). confirmed the quick fix; ’s upgrade theory is plausible because some distributions changed defaults.

Practical steps

  • Best practice: use full <?php ... ?> tags for portability.
  • If you prefer short tags, edit the active php.ini (find its path with phpinfo()), set short_open_tag = On, then restart the web server. Use the PHP docs for the short_open_tag setting for details: short_open_tag ini.

Quick check (create this file, open it in a browser to find the loaded php.ini):

<?php
phpinfo();
?>

Security and future-proofing

  • Avoid putting unsanitized $_SERVER['PHP_SELF'] into action (it can enable XSS). Sanitize the target or use an empty action/HTML5 behavior or a POST-Redirect-GET flow after processing. Example of a safer action:
    <form action="<?php echo htmlspecialchars(filter_input(INPUT_SERVER, 'REQUEST_URI', FILTER_UNSAFE_RAW), ENT_QUOTES, 'UTF-8'); ?>" method="post">
  • Also note the old mysql_* extension in the original script is deprecated/removed in modern PHP. Prefer mysqli or PDO for any current work.

One more note: since PHP 5.4 the short echo tag <?= is always available regardless of short_open_tag — useful when updating older code ().

Recommended Answers

All 5 Replies

Member Avatar for johny_d

That's because you try to use short_open_tag (<? instead of <?php ) as your php openning tag in

<form action="<?=$_SERVER['PHP_SELF']?>" method="post">

while you probably have it set in your php.ini to off:
short_open_tag = Off

That's why, when you run the script, your form looks like this:

<form action="<?=$_SERVER['PHP_SELF']?>" method="post">

instead of

<form action="/path_to_your_file.php" method="post">

hence the error.

On your previous server (configuration) (2 months ago), you probably had short_open_tag = On , and that's why the same script worked.

Php reccomends in php.ini to avoid using short_open_tag in your scripts, exactly beacuse of this. On some servers this option is not enabled and you get in a lot of trouble, the way you did.

So, to solve your problem, try to use:

<form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="post">

:)

Member Avatar for Eko

Hey thanks :) It worked . You we're right ,it was that short_hand thing.

You're the best

Member Avatar for johny_d

You're most welcome ;)

commented: good job +12
Member Avatar for jbennet

I think the reason it worked then didnt is did you upgrade?

a new version (i myself use XAMPP) came out recenly and the same thing happened to me. Seems they turned off the short tags as its the new default behaviour?

Member Avatar for Eko

I've used wamp 1.5.0 , 1.5.0.a , 1.7.1 , 1.4.2
All of them have the short_open_tag = Off by default , and I guess that all future versions will have this as well
It can be really frustrating.
They should ask you when u install it , if you want short tag on/off

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.