405 HTTP verb used to access this page is not allowed

Question

405 - HTTP verb used to access this page is not allowed. The page you are looking for cannot be displayed because an invalid method (HTTP verb) was used to attempt access.

I have a small contact form on my website, whenever I execute it this is the issue I am presented with. The code below is the .php file that is actioned when submitting the contact form.

<?php

if (isset($_POST['email'])) {

    // EDIT THE 2 LINES BELOW AS REQUIRED
    $email_to = "my email address";
    $email_subject = "Website Email";

    function died($error)
    {
        // your error code can go here
        echo "We are very sorry, but there were error(s) found with the form you submitted. ";
        echo "These errors appear below.<br /><br />";
        echo $error . "<br /><br />";
        echo "Please go back and fix these errors.<br /><br />";

        die();

    }

    // validation expected data exists

    if (!isset($_POST['first_name']) ||

        !isset($_POST['last_name']) ||

        !isset($_POST['email']) ||

        !isset($_POST['telephone']) ||

        !isset($_POST['comments'])
    ) {
        died('We are sorry, but there appears to be a problem with the form you submitted.');
    }

    $first_name = $_POST['first_name']; // required
    $last_name = $_POST['last_name']; // required
    $email_from = $_POST['email']; // required
    $telephone = $_POST['telephone']; // not required
    $comments = $_POST['comments']; // required

    $error_message = "";

    $email_exp = '/^[A-Za-z0-9._%-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,4}$/';

    if (!preg_match($email_exp, $email_from)) {
        $error_message .= 'The Email Address you entered does not appear to be valid.<br />';
    }

    $string_exp = "/^[A-Za-z .'-]+$/";

    if (!preg_match($string_exp, $first_name)) {
        $error_message .= 'The First Name you entered does not appear to be valid.<br />';
    }

    if (!preg_match($string_exp, $last_name)) {
        $error_message .= 'The Last Name you entered does not appear to be valid.<br />';
    }

    if (strlen($comments) < 2) {
        $error_message .= 'The Comments you entered do not appear to be valid.<br />';
    }

    if (strlen($error_message) > 0) {
        died($error_message);
    }

    $email_message = "Form details below.\n\n";

    function clean_string($string)
    {
        $bad = array("content-type", "bcc:", "to:", "cc:", "href");
        return str_replace($bad, "", $string);
    }

    $email_message .= "First Name: " . clean_string($first_name) . "\n";
    $email_message .= "Last Name: " . clean_string($last_name) . "\n";
    $email_message .= "Email: " . clean_string($email_from) . "\n";
    $email_message .= "Telephone: " . clean_string($telephone) . "\n";
    $email_message .= "Comments: " . clean_string($comments) . "\n";

    // create email headers
    $headers = 'From: ' . $email_from . "\r\n" .
        'Reply-To: ' . $email_from . "\r\n" .
        'X-Mailer: PHP/' . phpversion();
    @mail($email_to, $email_subject, $email_message, $headers);

    ?>


    <!-- include your own success html here -->

    I HAVE A PAGE HERE I'VE REMOVED IT FOR THE EASE OF LOOKING AT MY CODE.

    <?php
    unset($_SESSION['errors']);
    unset($_SESSION['fields']);
    ?>

    <?php

}

?>

I have tested this on a server on 123-reg and it works, however when loading it onto a fasthost server I have this issue. The correct url is under fasthost so I can't put it onto the 123-reg server.

Answer 1

Test to see what http methods are allowed by the host. To perform this test you need figure out which HTTP methods are supported by the web server that is being examined.

The testing method is extremely straightforward and we only need to fire up netcat (or telnet):

$ nc yourhost.com 80 
OPTIONS / HTTP/1.1
Host: yourhost.com

HTTP/1.1 200 OK
Server: Apache 2.2x
Date: Tue, 31 Oct 2006 08:00:29 GMT
Connection: close
Allow: GET, HEAD, POST, TRACE, OPTIONS
Content-Length: 0

The important thing is you see the verb POST in the result.

Also, check to see that the host is not doing url rewriting that creates some invalid request that is not obvious.