How to allow double quotes (quoation marks) in CodeIgniter URLs

Question

New to CodeIgniter but I've tried a few approaches:

Remove Characters from URL with htaccess / URL array codeigniter / CodeIgniter Disallowed Key Characters

I keep getting the same error when a URL that contains a double quote is used:

Disallowed Key Characters.

Please someone tell me what I'm doing wrong. This seemed so simple at first but clearly I'm not understanding.

Why would you want to do that? It is a security hole. Anyway urlencode may come handy: http://www.php.net/urlencode — Gustavo Rubio, Feb 13 '14 at 20:57
It's an ecommerce site with a lot of traffic and one of its traffic sources - Google Shopping - is sending a long string of variables attached to our traditional URLs which I'm assuming is some form of analytics tracking set up by a previous developer. — sparecycle, Feb 14 '14 at 02:55

score 0 · Answer 1 · answered Feb 13 '14 at 20:27

0

Open up the config folder in your CI directory look for the line:

$config['permitted_uri_chars'] = 'a-z 0-9~%.:_\-';

If you want to use double quotes add it there.

Next go to codeigniter->core->input.php

find the : _clean_input_keys($str) function

append this line: exit('Disallowed Key Characters.'.$str);

Now you should see the line that's causing your error and fix it accordingly.

answered Feb 13 '14 at 20:27

Edward

3,061
6
32
52

I think better to extend input class with /application/code/MY_Input.php than edit CI core – Egor Sazanovich Feb 13 '14 at 20:33
I was unable to get the above to resolve my issue but thank you still Edward. – sparecycle Feb 17 '14 at 22:44

score 0 · Answer 2 · answered Feb 17 '14 at 22:43

This is what seemed to work for me. I realize after consulting several sources there are various ways to resolve this issue. I modified this section inside of html/system/core/Input.php to match the following. I inserted a PHP function that that replaces instances of " with ' for the URL strings. Did the job.

 /**
  * Clean Keys
  *
  * This is a helper function. To prevent malicious users
  * from trying to exploit keys we make sure that keys are
  * only named with alpha-numeric text and a few other items.
  *
  * @access private
  * @param  string
  * @return string
  */
  function _clean_input_keys($str)
  {
     $str = str_replace('"','',$str);
    if ( ! preg_match("/^[a-z0-9:_\/-]+$/i", $str))
    {
      exit('Disallowed Key Characters...');
    }

    // Clean UTF-8 if supported
    if (UTF8_ENABLED === TRUE)
    {
      $str = $this->uni->clean_string($str);
    }

    return $str;
  }

How to allow double quotes (quoation marks) in CodeIgniter URLs

2 Answers2