I'm using the CodeIgniter PHP framework. I use JS to dynamically load a PHP page:
$('someIFrame').writeAttribute( 'src', '/index.php/controller/method/' + escape(userGeneratedString) );
When I ran this, CodeIgniter gave me this error:
http://192.168.0.81/index.php/controller/method/dude%27s%20face An Error Was Encountered The URI you submitted has disallowed characters.
This is totally untrue because the URL in question did not contain any disallowed characters. My config file allows all the characters present in that URL:
$config['permitted_uri_chars'] = 'a-z 0-9~%.:_()@\-';
So I got frustrated and just allowed all characters to prevent the error.
// Leave blank to allow all characters -- but only if you are insane. // DO NOT CHANGE THIS UNLESS YOU FULLY UNDERSTAND THE REPERCUSSIONS!! //$config['permitted_uri_chars'] = 'a-z 0-9~%.:_()@\-'; $config['permitted_uri_chars'] = '';
The warning message above this line sounds scary. What can possibly go wrong by allowing all characters? Will I get hacked?
The content is written by members of the stackoverflow.com community.
It is licensed under cc-wiki