I use ajax (POST) in javascript to send text data to be saved as a file on the server by a php program (which simply does an fopen, fwrite and fclose). This generally works OK.
However recently I have had some data where this process has resulted in a 403 Forbidden error. After much analysis I have found that if the data includes the characters 'having a ?' then the error occurs. But if I eg remove the 'h' or the '?' then no error occurs. I cannot see any spurious characters in the data.
How can the content of the data uploaded affect whether the 403 error occurs or not?
Edit
I know something about programming, but very little about the WebServer environment. I only have FTP access to the server.
When the 403 occurs the error function from my AJAX call is getting triggered, so an alert tells me it has failed, and it shows in the console:
- xhr.status: 403
- xhr.responseText: [HTML code with title 403 Forbidden; body heading Forbidden, and text: You don't have permission to access /ShowMapsDev/savetext.php on this server. Additionally, a 403 Forbidden error was encountered while trying to use an ErrorDocument to handle the request]
- thrownError: Forbidden
A little bit more on the behaviour:
It seems very reproducible as I have moved the code and data to a Test environment (on the same server) and I get the same behaviour (ie any data with exactly "having a ?" gives a 403 error, but without it there is no error).
I did have a similar problem a few months ago, but the triggering string was different ("Descri"). I needed to get on with my project, so having identified the issue I did a Kluge (altered the specific text). That string does NOT seem to trigger the 403 issue now.
I do have a .htaccess file, but that is unchanged for quite a while and just has rewrite rules to change http to https, to allow a shortened form of URL, and some entries generated by the Pretty URLs mod of SMF. I cannot see any of these causing my issue.