Re: [PHP] PHP 5.2 + IE 7 = HTTP 304 in login procedure [SOLVED]

2007-03-12 Thread Doctorrock

2007/3/12, Yannick Warnier <[EMAIL PROTECTED]>:


The problem wasn't quite there. The 304 response was correct and didn't
really cause a problem in IE7.

In fact, the problem was somewhere else. As mentioned by someone in the
PHP doc comments (http://be.php.net/manual/en/ref.session.php#64125 ),
IE is the only one to reject urls of the likes of
http://example_demo.littleweb.com/ because of the "_" character.

This means that basically IE will display the site without a problem,
but will not register any cookie, and of course will not mention it, so
it makes it all much easier to detect. The fact that FF and Opera get a
session each does not help at all in finding the problem.

Changing the URL to http://exampledemo.littleweb.com/ will work perfectly.

Yannick



According to RFC1033 (
http://www.camtp.uni-mb.si/books/Internet-Book/DNS_NameFormat.html ),
underscores are forbidden in DNS names, including subdomains.


Re: [PHP] Re: Posting variable outside of the post form

2007-03-13 Thread Doctorrock

Mpff, you should start by minding XSS attacks on PHP_SELF, and no echoing it
as raw ... :
http://blog.phpdoc.info/archives/13-XSS-Woes.html