Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>Put the "<strong>-</strong>" at the end of the string otherwise it gets interpreted as range. The % is already in the allowed character list as you can see.</p> <pre><code>$config['permitted_uri_chars'] = 'a-z 0-9~%.:_+-'; </code></pre> <hr> <p>Ahem... after looking at your sample string again. Here is why you get "<code>The URI you submitted has disallowed characters</code>".</p> <p><strong>Short explanation</strong>: Add the ampersand <strong>&amp;</strong> to the allowed characters list</p> <pre><code>$config['permitted_uri_chars'] = 'a-z 0-9~%.:_+&amp;-'; </code></pre> <hr> <p><strong>Long explanation</strong></p> <p>There are 2 things playing together.</p> <p><strong>A)</strong> CodeIgniter checks all URI <strong>segments</strong> for disallowed characters. This happens by whitelisting allowed characters. Which ones are allowed can be checked in /<em>system/application/config/config.php</em> in the <code>$config['permitted_uri_chars']</code> variable. The default value is set to something like <code>'a-z 0-9~%.:_-'</code>. Thus all letters from a to z, space, all numbers and the following characters *~%.:_- are allowed.</p> <p>Ok let us compare that to your sample URI which you say works</p> <pre><code>a-z 0-9~%.:_- DO_SOMETHING/Coldplay/Fix+You/273/X+26+Y/ //note the missing % </code></pre> <p>All characters are ok... but wait what about the plus sign <strong>+</strong>? It's not in the list of allowed characters! And yet the URI is not complained about? This is the key to your problem.</p> <p><strong>B)</strong> CodeIgniter <a href="http://www.php.net/urldecode" rel="noreferrer">urldecodes</a> the URI segments prior to the whitelist-character-check to prevent that someone circumvents the check by simply urlencoding the URI. Thus the <strong>+</strong> gets decoded to a space. This behaviour is because of <a href="http://www.php.net/urlencode" rel="noreferrer">urlencode</a> (which encodes spaces as <strong>+</strong> sign, deviating from <a href="http://www.faqs.org/rfcs/rfc1738.html" rel="noreferrer">RFC 1738</a>). That explains why the <strong>+</strong> sign is allowed.</p> <p>These two things combined explain also why this specific URI doesn't work.</p> <pre><code>urldecode(DO_SOMETHING/Coldplay/Fix+You/273/X+%26+Y/) //evaluates to //DO_SOMETHING/Coldplay/Fix You/273/X &amp; Y/ </code></pre> <p>Whoops... the urldecoding translates <strong>%26</strong> to an <strong>&amp;</strong></p> <p>Which isn't an allowed character. Mistery ;-) solved</p>
    singulars
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
    2. VO
      singulars
      1. This table or related slice is empty.
    3. VO
      singulars
      1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload