views:

30

answers:

1

I'm having the strangest issue with codeigniter. I have a site that has a search feature which displays the person's query in the url so that they can save the url. I make sure that the query text has gone through rawurlencode before I stick it in the url. However, Codeigniter still shoots me to an error page when there's a character in the query that isn't in my permitted_uri_characters configuration.

So even though my browser says /search-results/query/%22samplequery%22, I’m still getting the error about using non-permitted characters.

Is this a bug? I don’t have non-permitted characters in my url. I have a % sign and some numbers (which are all specifically permitted). It’s definitely the permitted_uri_characters setting that’s giving me grief. If I add a quotation mark to it, it allows the %22 query through no problem.

And to be clear, the query is coming from a form as post data, then being encoded in my controller and then redirected to a new page. There’s no way that the permitted_uri_characters is somehow being applied BEFORE it gets encoded.

This is driving me batty, as my only solution at the moment is to open up my permitted_uri_charcters to everything under the sun, which isn't very secure!

A: 

Could it be URL encoding the %20 to a " before codeigniter verify' it? How about adding that to the permitted char's list.

Kieran Andrews
Well, numbers and % signs are allowed, and I already know I can get it to work if I add a quotation mark to the permitted characters list. My problem is that I don't WANT to add a quotation mark to the permitted characters list, because I shouldn't have to, and I'm trying to keep security as tight as possible.
neomech