Some chars encoded during POST while others are not

Question

TL;DR CodeIgniters' Security Class directly manipulates your Globals such as `$_POST` and it finds `file()` and `file ()` to be a threat so it HTML encodes it. ``` // config.php from my apps folder is the culprit $config['global_xss_filtering'] = TRUE; ``` Do-It-Yourself (the few, the brave) In CodeIgniter 2.1.4 go to `system/core/security.php` and line #430-442: ``` /* * Sanitize naughty scripting elements * * Similar to above, only instead of looking for * tags it looks for PHP and JavaScript commands * that are disallowed. Rather than removing the * code, it simply converts the parenthesis to entities * rendering the code un-executable. * * For example: eval('some code') * Becomes: eval&#40;'some code'&#41; */ $str = preg_replace('#(alert|cmd|passthru|eval|exec|expression|system|fopen|fsockopen|file|file_get_contents|readfile|unlink)(\s*)$(.*?)$#si', "\1\2&#40;\3&#41;", $str); ``` Observation/question Basically, it seems as though either PHP or Apache sees `file ()` or `file()…

Accepted Answer

According to the user guide, you can get rid of this by setting

```
$config['global_xss_filtering'] = FALSE;
```

Or just remove this line.

IMHO, it's a design failure to modify the `$_POST` array, but there you go.

Some chars encoded during POST while others are not

Solution

Problem