TOCs with useless "contact us" forms

[Adam Williams]

I've just spent the last ten minutes wasting my time on this before being given a simple email address which could've saved me all the bother initially.

CrossCountry has a form that customers can fill in, but clearly whoever is responsible for the form didn't know how to mitigate SQL injection - because they've "fixed" this security problem by forcing the customer not to type apostrophes (ends a quoted string), percent signs (can be used in a LIKE query), semicolons (ends a statement) or dashes (comments out a statement) in their comment. The only problem: Semi-colons and apostrophes are entirely normal characters to type in English! We use them in possessive plurals and contractions all the time!



Nobody competent would design a form like this.


After I'd wasted the time removing all of the banned characters, I initially got a completely blank HTTP "Bad Request" response, with no way to recover the entered text and no explanation as to what had gone wrong:



I hit back and the form was completely empty with all of the input I had entered gone.

I managed to recover what I typed (which I don't think most users would be able to do) and tried the whole process again in a different browser without any "bad" characters:



Useless.

The cynical part of me concludes this is entirely deliberate, with the aim of reducing customer correspondence so that it simply doesn't need to be dealt with. Who is going to persist through all of this nonsense, and re-entering their complaint three times to get correspondence to actually be sent?

 

[Blinkbonny]

Yes, this rings a bell with me. Can't swear it was with Cross Country, but I recall having to remove these fairly standard characters for reasons which I just couldn't understand!

Interesting to know there is some kind of explanation behind it. But as you say - ridiculous!

 

[transportphoto]

I had a nightmare trying to find a phone number for XC on their website yesterday. Every detail but seems to be made obvious.

In the end I specifically googled “Cross Country phone number” and Google done the work for me.

 

[lyndhurst25]

Will remember to type “does not” instead of “doesn’t”, and “the doors of the train” instead of “the train’s doors” in future!

It’s bit like ebay trying to stop users passing on phone numbers in messages between buyers and sellers. They do this to try and stop them completing sales “cash in hand” so eBay doesn’t get their cut, but it can be a big problem if you need to keep in touch to arrange collection of an item for example. Even typing out a phone number in words gets picked up and blocked. I had to resort to using Roman numerals to bypass the silly web form restrictions.

 

[KirkstallOne]

I've just spent the last ten minutes wasting my time on this before being given a simple email address which could've saved me all the bother initially.

CrossCountry has a form that customers can fill in, but clearly whoever is responsible for the form didn't know how to mitigate SQL injection - because they've "fixed" this security problem by forcing the customer not to type apostrophes (ends a quoted string), percent signs (can be used in a LIKE query), semicolons (ends a statement) or dashes (comments out a statement) in their comment. The only problem: Semi-colons and apostrophes are entirely normal characters to type in English! We use them in possessive plurals and contractions all the time!

View attachment 170262

Nobody competent would design a form like this.


After I'd wasted the time removing all of the banned characters, I initially got a completely blank HTTP "Bad Request" response, with no way to recover the entered text and no explanation as to what had gone wrong:

View attachment 170264

I hit back and the form was completely empty with all of the input I had entered gone.

I managed to recover what I typed (which I don't think most users would be able to do) and tried the whole process again in a different browser without any "bad" characters:

View attachment 170263

Useless.

The cynical part of me concludes this is entirely deliberate, with the aim of reducing customer correspondence so that it simply doesn't need to be dealt with. Who is going to persist through all of this nonsense, and re-entering their complaint three times to get correspondence to actually be sent?

Interesting, one wonders what db that form is ultimately connected to.

As you probably know, as well as the annoyance of not allowing perfectly normal characters in a free text field, trying to prevent SQL injection by blacklisting certain characters is not the correct approach - there are too many encoding schemes and injection approaches to guard against.

 

[Doctor Fegg]

Nobody competent would design a form like this.

I wonder whether the validation is done server-side or client-side...

 

[Randomer]

I would post the drop tables XKCD but it is perhaps a little too niche a subject.

I really do wonder about the competence of the person who came up with that as a design choice rather than doing proper SQL injection mitigation, it doesn't say good things about the design process or supervision. Probably a good thing that Crosscountry outsource their ticketing solution although I do wonder how well setup their delay repayments system is (unless it is outsourced as well).

Also it doesn't seem to have blocked < or > which is an interesting choice (as companies house and others have learnt)...

 

[John Palmer]

Confirms my thesis that any idjit can design/write software, but it takes genuine talent to design/write good software.

A problem not confined to software. I've lost count of the occasions when I've muttered to myself “If only I could get my hands round the neck of the fickwut who designed this widget...”

 

[Egg Centric]

I note the form accepts backslashes

 

[Trackman]

Wouldn't surprise me if they did it deliberately so the user would give up.

 

[OscarH]

I had problems with the GTR form many times, you get to the end of the 4 step wizard, have typed all your comment, then the submit button doesn't do anything. Not bad internet or not giving it time, it's just broken. Luckily emailing comments@ open a ticket exactly as the form does and actually works