PunBB Resource

Your ultimate PunBB resource!

Keywords:

    (Extended)

You are not logged in.

#1 2009-10-08 21:26:14

Federer Photography
Member
From: Minneapolis, MN
Registered: 2009-08-19
Posts: 10
Website

SQL injection protection? (Can't post keywords)

My forum is running into issues.

Users can't post posts that contain certain keywords.  At first it was just the word "drop" ... then "insert" ... but now it's basically made the forum unusable because it won't allow posts containing "from" either.

When you go to post (or preview) the message, the browser just cranks and the post/preview never gets made...  eventually the browser times out.  Remove the single offending word and it goes slick as a whistle.

It's only on certain posts as well... I can open a new post, type the word "from" and post it with zero issues.

Thoughts?

Offline

 

#2 2009-10-09 01:01:58

seesaw
Member
Registered: 2007-04-27
Posts: 164

Re: SQL injection protection? (Can't post keywords)

Have you or your host got mod_security running on your Apache server?

Offline

 

#3 2009-10-09 05:12:55

Federer Photography
Member
From: Minneapolis, MN
Registered: 2009-08-19
Posts: 10
Website

Re: SQL injection protection? (Can't post keywords)

How would I find out, and if it is running, how would I turn it off and/or fix the issue?

Offline

 

#4 2009-10-09 23:50:51

Federer Photography
Member
From: Minneapolis, MN
Registered: 2009-08-19
Posts: 10
Website

Re: SQL injection protection? (Can't post keywords)

More interestingly, why would it be getting worse and/or only happen on certain posts/topics/strings of words?

Offline

 

#5 2009-10-12 21:43:11

seesaw
Member
Registered: 2007-04-27
Posts: 164

Re: SQL injection protection? (Can't post keywords)

mod_security is a addon to the Apache webserver that filters requests to the server.

It has a set of rules designed to filter suspicious requests, such as those that may be XSS or SQL injections etc, as well as numerous other filter rules. These rules are updated frequently and may be changed all the time by your web admin or host.

Quite often these rules do interfere with legitimate interactions with the web server.

Turning it off will depend on how it has been configured on your system. Sometimes it is something you can do via .htaccess, sometimes you will need to get the sysadmin to disable a specific rule server wide or for your account.

mod_security may only be a part of it though. There are lots of other filters, firewalls, proxies, caches, security appliances etc that sit in front of a lot of sites and servers that may also be responsible. But it is a good place to start your debug trail.

Offline

 

#6 2009-10-12 21:45:09

Federer Photography
Member
From: Minneapolis, MN
Registered: 2009-08-19
Posts: 10
Website

Re: SQL injection protection? (Can't post keywords)

Thanks a lot, I'll report back any findings and/or solution.

For now, I've just directly edited the SQL database. (not something available to the rest of my users, however)

Last edited by Federer Photography (2009-10-12 21:45:26)

Offline

 

Board footer

Based on PunBB
© Copyright 2002–2005 Rickard Andersson

© Copyright 2004–2006 Kristoffer Jansson

User contributed files are property of their respective owners.