CODEWITHSUNDEEP
phpcodeigniter
user2694306
user2694306

Reputation: 4050

Receiving "Disallowed Key Characters" error in CodeIgniter

I am getting the following message: Disallowed Key Characters and the string producing the message seems to be

__utmt_~42

I am just trying to load the page and for the life of me can't figure out why this is happening. It started out of nowhere. How can I locate the source of this?

Upvotes: 3

Views: 25890

Answers (6)

Die-Bugger
Die-Bugger

Reputation: 176

Though its a old post, its still relevant today as the message is cryptic and brings the website to its knees in no time.

In my case, in the test system, all of a sudden, started receiving this message for every page that gets an user input through GET/POST. Later found that to be the result of additional filter I added recently to the php.ini as below, which promised, to configure the default filter to behave exactly like htmlspecialchars().

[filter]
filter.default = full_special_chars
filter.default_flags = 0

On removing these filters from the php.ini file, the error was gone. Hope this helps somebody who encounters the same problem.

Upvotes: 0

p431i7o
p431i7o

Reputation: 11

In case you have this problem with recaptcha of google (POST variable named g-recaptcha-response) in my case was solved adding a escaped hyphen at the end of the listed characters like this:

    if ( ! preg_match("/^[~a-z0-9:_\/-\|\-]+$/i", $str)){

to the file system/core/Input.php

Upvotes: 0

Grrrben
Grrrben

Reputation: 325

Had a similar problem, so, for the sake of Google search results:

__utmt is a cookie. More specificly, a Google Analytics cookie. The ~Number part probably means it's a copy/duplicate. Think of it like the word.doc~1 files that are stored on your computer when working in a Word doc.

So first, check your Analytics code on the website, is there a duplicate somewhere? My problem was solved by altering this duplicated line: 

var pageTracker = _gat._getTracker("UA-1234567-89");
var pageTracker = _gat._getTracker("UA-1234567-89");

Weird thing is that the file always had this duplicated line of code, for as far as my GIT goes back. It might be a change in the way analytics code handles cookies...

Oh, and the "Disallowed Key Characters" part. That's normally a good thing, protecting your CI app against evil.

Its in the system\core\Input.php file. 

if ( ! preg_match("/^[a-z0-9:_\/-]+$/i", $str)) {
    // there is no ~ in this regex pattern
    // You could add it, but you probably end up breaking other stuff ("/^[\w:~\/]+$/i")
    exit('Disallowed Key Characters');
}

Upvotes: 5

Ahmad Zaib X-Islamian
Ahmad Zaib X-Islamian

Reputation: 81

Follow the following steps

  1. Search for function _clean_input_keys on /system/core/Input.php
  2. update this exit(‘Disallowed Key Characters.’); to exit(‘Disallowed Key Characters.’ . $str);

Upvotes: 6

Trevyn Meyer
Trevyn Meyer

Reputation: 21

Change on system/core/Input.php

if ( ! preg_match("/^[a-z0-9:_\/-]+$/i", $str))
                {
                      exit('Disallowed Key Characters.');
                }


to 

if ( ! preg_match("/^[a-z0-9:_\/-~]+$/i", $str))
                {
                      exit('Disallowed Key Characters.');
                }

Upvotes: 2

Junosapien
Junosapien

Reputation: 86

I was just going to comment, but I do not have enough reputation, apparently. I had a similar problem this morning. It was being caused by a cookie (__utmt_~1). My site does create a cookie called __utmt but not with the single underscore, tilde and 1. I suspect that __utmt_~1 is a duplicate of the original cookie, but I am not sure how it was created. However - clearing my cookies stopped the Disallowed Key Characters message.

Upvotes: 1

Related Questions