1

I have a search bar for my website that keeps sending weird error messages when I type certain things into the search. Here is the page. http://www.pearlsquirrel.com/searchmusic.php. If I were to type in this "<><>" it sends me a message saying

Forbidden

You don't have permission to access /searchmusic.php on this server.

I have tried to contact my hosting provider but they are of no help. I htink that this might be a problem with apache, but I do not know for sure. If anyone knows how to fix this error, any help would greatly be appreciated.

Eggo
  • 541
  • 7
  • 18
  • are you able to change the permissions on the file searchmusic.php? it seems your Apache user does not have access to that file. – Matt K Mar 06 '12 at 21:53
  • I am able to change the permissions on my searchmusic file. It is currently at 6 4 4 and it did not work at 7 5 5. – Eggo Mar 06 '12 at 21:55
  • Any regular search works. The error only occurs when I type in the above characters. – Eggo Mar 06 '12 at 21:56
  • A can't seem to reproduce this problem. I see the requests when I type in `<><>`, but they all return 200. Tried including the `""` as well. Same result. – GolezTrol Mar 06 '12 at 21:56
  • Do you have any idea why it would be ocurring on only my computer then? – Eggo Mar 06 '12 at 21:58
  • This is the full error that i get. Forbidden You don't have permission to access /searchmusic.php on this server. Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request. Apache Server at www.pearlsquirrel.com Port 80 – Eggo Mar 06 '12 at 21:59

1 Answers1

1

HTTP 403 errors may be thrown by security modules if they identify strange requests coming down the Apache pipeline. This is especially true if you are using a module like Mod Security.

In your case, sending a request with <><> may seem suspicious to the server, as it may interpret it as intending to find a vulnerability (a la SQL injection or what have you).

Matt Beckman
  • 5,022
  • 4
  • 29
  • 42
  • That makes sense. Is there any way to have it stop showing me these messages? – Eggo Mar 06 '12 at 22:05
  • If it's ModSecurity, check the log file for that module. you should be able to identify which security rule it was that triggered the error. – Emil Vikström Mar 06 '12 at 22:15
  • If you want to support these special characters, then you should also convert the search query to URL encoded characters. See this question: http://stackoverflow.com/questions/332872/how-to-encode-a-url-in-javascript – Matt Beckman Mar 06 '12 at 23:22