Forbidden Error When Submitting Simple PHP Form

Given that you’re able to post, and that your post-handling is apparently extremely simple and so unlikely to be throwing 403 errors or redirecting to forbidden directories, I’m going to hazard a guess that you’re running an apache-level firewall. Have a look at your apache config files, and check to see if you’re running mod_security or any other firewall module loaded. There are a number of ways mod_security can be configured, including scanning POST data for html content and reacting accordingly. If it is configured to prevent html injection, this may be your issue (see configuration details here: http://www.modsecurity.org/projects/modsecurity/apache/feature_content_injection.html).

To test this, try adding an htaccess file into your web root (assuming you’re allowed to override apache settings with htaccess) and setting:

SecFilterEngine Off

Restart apache and then see if it’s still happening.

If this is a shared host, or you otherwise don’t have the ability to modify apache settings, you can try a workaround using javascript that base64 encodes all the data before submitting (onsubmit), and then base64_decode($_POST[key]) in the php script that processes it.

Leave a Comment