PHP 5.2.x: $_POST is empty when any field has valu

问题:

Very weird bug!

When at least 1 form field has value of "zeroOrMoreWords drop oneOrMoreWords from oneOrMoreWords", the $_POST comes empty! Just to confirm to myself I'm not crazy, I tried the same thing on another website that uses PHP 5.2.11 and happens the same thing!

I tried:

• PHP 5.2.8 = $_POST comes empty.
• PHP 5.2.11 = $_POST comes empty.
• PHP 5.2.14 = Works fine.
• PHP 5.3.5 = Works fine.

Any explanation to this weird thing?

Here's a live example on a famous website: https://www.deviantart.com/users/login try to insert "drop xxx from xxx" in username field, and type anything for password field, the form will come back without showing any errors!

回答1:

Sounds like apache *mod_security* or something similar is active. If it thinks something is SQL injection or something else that is bad, it will remove the POST data.