使用XMLHttpRequest提交评论表单时遇403 Forbidden错误求助

问题描述 #

使用XMLHttpRequest提交基础评论表单时，始终在load事件监听器中收到403错误，但同一套逻辑的订阅表单（newsletter）提交却能正常处理。已做如下排查：

• 将两个表单提交到同一PHP脚本，仅订阅表单数据能被处理，评论表单始终返回403；
• 改为提交到不同脚本，结果依旧；
• 排除文件权限问题，浏览器可正常访问目标PHP文件；
• 尝试重新创建FormData对象提交，无效；
• 本地服务器测试时表单提交正常，仅上传到线上服务器后出现问题；
• 在Chrome、Firefox及移动浏览器中测试，均是订阅表单提交成功，评论表单失败。

前端代码 #

function commentSubmissionResponse(event) {
  let response = this.responseText.split(":");
  let error = this.sender.querySelector(".error")
  if (response[0] == 'OK') {
    error.innerHTML = "Your comment has been successfully submitted. Thank you"
    this.sender.querySelector('*[type=submit]').disabled = true
  } else if (response[0] == 'BAD') {
    error.innerHTML = response[1]
  } else {
    error.innerHTML = "Submiting your comment failed!, please try again later"
  }
}
//This function was handling submission of another form to the same target but only worked for the other form, so I have split them up, changed the server side target, recombined them, everything I can think of. This is my latest version

function comments(event) {
  let xhttp = new XMLHttpRequest()
  xhttp.open("POST", "/serversideReceiver.php", true);
  //let formData=new FormData(form); here I was just submitting the form data directly but after no I success tried to extract the data
  const form = document.forms['comment']

  let formData = new FormData(form)
  xhttp.sender = form;
  formData.set("comment", true);
  formData.set("name", form.elements['name'].value)
  formData.set("email", form.elements['email'].value)
  formData.set("subject", form.elements['subject'].value)
  formData.set("message", form.elements['message'].value)

  xhttp.onload = commentSubmissionResponse
  xhttp.send(formData)
  return false
}

后端PHP代码 #

//This is accessed by both xmlhttprequests (since they are now split),
// but even when they are joined, it only works for the **newsletter** data.

<?php 
include_once 'DBConnector.php';

if ( $_SERVER["REQUEST_METHOD"] == "POST"){

    if(isset($_POST['newsletter'])){
        $name=sanityCheck($_POST['name']);
        $email=sanityCheck($_POST['email']);

        $test_email_stmt=$connection->prepare("SELECT * from subscribers where subscriber_email = ?");
        $test_email_stmt->bind_param("s",$email);
        $test_email_stmt->execute();


        $result = $test_email_stmt->get_result();
        $row = $result->fetch_assoc();
        if($row){
            echo("BAD:".$row['subscriber_email']." already registered!");
            $test_email_stmt->close();
            return;
        }

        $test_email_stmt->close();
        $stmt = $connection->prepare("INSERT INTO subscribers (subscriber_name,subscriber_email) VALUES(?,?)");
        $stmt->bind_param("ss",$name,$email);
        $stmt->execute();
        if($stmt->affected_rows){
            echo "OK";
        }else{
            echo "Error: Registration Failed. Try again later";
        }
        $stmt->close();

    }elseif (isset($_POST['comment'])) {
        $name=sanityCheck($_POST['name']);
        $email=sanityCheck($_POST['email']);
        $subject=sanityCheck($_POST['subject']);
        $message=sanityCheck($_POST['message']);

        $stmt=$connection->prepare("INSERT into comments (commenter_name,commenter_email,commenter_subject,commenter_message) VALUES(?,?,?,?)");
        $stmt->bind_param("ssss",$name,$email,$subject,$message);
        $stmt->execute();
        if($stmt->affected_rows){
            echo "OK";
        }else{
            echo "Error: Comment Submission Failed. Please try again later";
        }
        $stmt->close();

    }else{
   
        die();
    }
}else{
   
        die();
    }

内容的提问来源于stack exchange，提问作者mwas