#1
  1. No Profile Picture
    Registered User
    Devshed Newbie (0 - 499 posts)

    Join Date
    Feb 2012
    Posts
    3
    Rep Power
    0

    Question Error if ; in text field on form


    Hey Guys,

    I've been lurking here but haven't had to post before. Now I'm racking my brain on this for almost a week. I've tried numerous searches and come up blank.

    I'm not normally a CF developer (haven't done it in about 12 years), but I inhereted a very simple app that needs modification. I've gotten through all the modifications and fixed most issues; created new pages, etc; but this one I can't get past.

    Background - inhereted CF app; very simple in nature; handful of fields on a form which on action, post into a database, then display a confirmation page with the details. The original creator seems to have written it in more HTML than CF (regular form and field inputs, not CFFORM, CFTEXTAREA, etc).

    What's tripping me up is that if someone enters a semicolon into any of the text input fields or the textarea field, on submit we get a "404-File or Directory not found"

    Ultimately what I want is for anything that's entered to be HTML friendly since the result is only used in an HTML email or to display on-screen in HTML;

    Could this be something glaringly simple like the wrong tags or a simple attribute that needs to be added, or what am I missing? I would've thought if it were a common mistake it'd come up easily in a google search, but no such luck.

    Any tips greatly appreciated!
  2. #2
  3. No Profile Picture
    Moderator

    Join Date
    Jun 2002
    Location
    Raleigh, NC
    Posts
    5,278
    Rep Power
    968
    Typing a semicolon into a text field should not do this, so something else has to be going on. Is the form action GET instead of POST? Can you show the form tag, the field in question, and any relevant JavaScript (if any JS is running on submit)?
  4. #3
  5. No Profile Picture
    Registered User
    Devshed Newbie (0 - 499 posts)

    Join Date
    Feb 2012
    Posts
    3
    Rep Power
    0
    I thought it seemed pretty abnormal; I would think CF would help with this fairly automatically.

    Here's some of the code; it was previously just form fields, but I've been converting them to CF form/field types:
    Code:
    <cfform name="RMARequestForm" action="RMA_sheet_action.cfm" method="post" format="html">
    <td colspan=6><cftextarea name="SpecialInstructions" html="yes" cols=100 rows=10 maxLength=255></cftextarea></td>
    
    <td><input type="submit" name="Process" value="Submit"></td>
    
    </cfform>
    The action is just a cfquery with an insert into the table using value <cfqueryparam cfsqltype="CF_SQL_VARCHAR" value="#Evaluate(HtmlEditFormat("FORM.Comments") & i)#">

    I don't currently have any javascript on the page or any onsubmit type actions.
  6. #4
  7. No Profile Picture
    Registered User
    Devshed Newbie (0 - 499 posts)

    Join Date
    Feb 2012
    Posts
    3
    Rep Power
    0
    Hrm - well this could be the culprit - maybe it was the previous develper's attempt at preventing SQL injection attacks? I just found this code in a file that must get referenced during page load:

    Code:
    <cfif Find(";",CGI.QUERY_STRING) GT 0 OR ListFindNoCase("CHAR,EXEC,DECLARE",cgi.query_string)>
    	<cfheader statuscode="404" statustext="Not Found">
    	<cfabort>
    </cfif>
    <cfif IsDefined("FORM") AND IsDefined("FORM.FIELDNAMES")>
    	<cfloop list="#FORM.FIELDNAMES#" index="i">
    		<cfif Find(";",FORM[i]) GT 0 OR ListFindNoCase("CHAR,EXEC,DECLARE",FORM[i])>
    			<cfheader statuscode="404" statustext="Not Found">
    			<cfabort>
    		</cfif>	
    	</cfloop>
    </cfif>
    <cfapplication name="iwi" sessionmanagement="yes">
    <cfset request.dsn="isidsn">
    
    <cfinclude template="header.cfm">
  8. #5
  9. No Profile Picture
    Moderator

    Join Date
    Jun 2002
    Location
    Raleigh, NC
    Posts
    5,278
    Rep Power
    968

IMN logo majestic logo threadwatch logo seochat tools logo