Banner Image Banner Image Banner ImageHomeContactLinksArtBlog Archives
Apache mod_security Internal Server Error by Neorush 2007-02-06 - 16:09:30
      So I keep getting a "500 Internal Server Error" on this one script. Why I don't know...it works fine 99% of the time, so I narrow it down to one page of data. (its all dynamic forms for editing products that's paginated). and then down to one piece of data, and finally down to one sentence....with this sentence in the paragraph....I get a 500 Internal Server Error, I take this sentence out and it works great.....this confueses me.....so I do what I should have done first and check out the error_log, and I see this:

[Tue Feb 6 09:48:54 2007] [error] [client 127.0.0.1] mod_security: Access denied with code 500. Pattern match "(insert[[:space:]]+into.+values|select.*from.+[a-z|A-Z|0-9]|select.+from|bulk[[:space:]]+insert|union.+select|convert.+\\\\(.*from)" at POST_PAYLOAD [id "300016"][rev "2"] [msg "Generic SQL injection protection"] [severity "CRITICAL"] [hostname "localhost"] [uri "/product_categories.php"]

Lesson number one: Kids...check the error log first...it can save you a lot of time.
Lesson number two: apache modules can be a pain in the donkey.
Lesson number three: You can disable mod_security by adding these lines to a .htaccess:
SecFilterEngine Off
SecFilterScanPOST Off

However....this module does protect against poorly written code (as well as possible software vulnerabilities) by using regular expressions to check for things like SQL Injections (Note the error above). It is a good module, so only disable it where you have to, it could save your donkey from that time you forgot to add:
if(isset($_POST["id"]) && is_numeric($_POST["id"])){
        //select from my database
}

That is all.

There are no comments for this post yet.

Home | Contact | Linkage | Art | Archives
Server has been up: 18 days 22 hrs 20 mins and 27 secs
Built in 0.06720 secs.
Valid HTML 4.01! Valid CSS! GeoURL