CI automatically filters out percent percent after the two-bit problem solving _php tutorial

In the CodeIgniter website, you want to enter a code:

$var = sprintf ("%04d", 2);

But when the storage is found, the code becomes

$var = sprintf ("D", 2);

In the online environment, the local environment has been tested, and the final confirmation is the problem of the CodeIgniter system. The following is a discussion of the problem solving process and thinking method:

1. Is it config.php's permitted_uri_chars?

$config [' permitted_uri_chars '] = ' A-Z 0-9~%.:_\-';

On the StackOverflow to find a few similar questions, there is the answer to change config.php permitted_uri_chars on the line.

Ahem looking at your sample string again. Here's why do you get " The URI you submitted has disallowed characters ".

Short Explanation:add the ampersand & to the allowed characters list

$config [' permitted_uri_chars '] = ' A-Z 0-9~%.:_+&-';

Tried, no effect, and then looked for the code that applied $config [' Permitted_uri_chars '].

2. Is Core/input.php's _clean_input_keys () function a problem?

function _clean_input_keys ($str)   {   $config = &get_config (' config ');   if (! Preg_match ("/^[". $config [' Permitted_uri_chars ']. "] +$/i ", Rawurlencode ($STR)))   {   exit (' disallowed Key characters. ');   }   Clean UTF-8 if supportedif (utf8_enabled = = = TRUE) {$str = $this->uni->clean_string ($STR);} return $str;   

This function uses the $config [' Permitted_uri_chars '] to directly filter the post data, a big reason is the culprit. I took it out alone, and after testing it found that post $var = sprintf ("%04d", 2); Come, the result is still $var = sprintf ("%04d", 2); ,%04 has not been filtered, it seems to have to look carefully.

3. Is it a defensive mechanism for XSS?

StackOverflow has a person who says he has solved the problem perfectly and is the reason for XSS clean.

:) God damn UrlDecode, I had looked at the code in uri.php and the XSS clean was doing the job so I missed it. Thank everything is perfect. –radum

So I found the Xss_clean () function under the core/security.php. The function Body code all commented out, found that the input will still filter out the%04, obviously not the problem of XSS.

4. The problem is the _clean_input_data () function

Back to input.php, found _clean_input_data and _clean_input_keys have links.

$new _array[$this->_clean_input_keys ($key)] = $this->_clean_input_data ($val);

So the function body of _clean_input_data () is commented out, unexpectedly input is not filtered. Continue to narrow down and discover that this code is a curse:

Remove control characters//This will filter out the%0x $str = Remove_invisible_characters ($STR);

5. The culprit found the remove_invisible_characters () function

So what is the function of Remove_invisible_characters ()?

This function is in core/common.php, I pull it out:

function Remove_invisible_characters ($str, $url _encoded = TRUE) {$non _displayables = array ();//Every control character Except newline (dec)//Carriage return (dec), and Horizontal tab (DEC) if ($url _encoded) {$non _displayables[] = '/% 0[0-8bcef]/';//URL encoded 00-08, one, one, all, 15$non_displayables[] = '/%1[0-9a-f]/';//URL encoded 16-31} $non _displayabl es[] = '/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]+/s ';//00-08, one, one, 14-31, 127do{$str = preg_replace ($non _displayables, ', $ STR,-1, $count);} while ($count); return $str;}

Look at these lines of code:

if ($url _encoded) {$non _displayables[] = '/%0[0-8bcef]/';//URL encoded 00-08, one, one, one, 15$non_displayables[] = '/%1[0-9 a-f]/';//URL encoded 16-31}

Clearly, he will filter out the 3 characters that start with%0 and%1. Just comment this out and solve the problem.

Document the whole process of thinking that this problem is solved.

http://www.bkjia.com/PHPjc/752355.html www.bkjia.com true http://www.bkjia.com/PHPjc/752355.html techarticle in CodeIgniter website, want to enter a piece of code: $var = sprintf ("%04d", 2), but when the storage is found, the code becomes $VAR = sprintf ("D", 2); In the online environment, the local environment is ...

