I've got an EE 2.8.1 site where one user cannot access a specific channel. He gets the message "Disallowed Key Characters". It only happens for this single user. Highlights:

  • Only happens for the one user
  • User is part of a member group and no one else in the member group has the issue
  • I've walked him through clearing all of his cache, cookies, history, everything. switched from his ISPs DNS to Google helped flused his local DNS hoping to clear everything out, all with no success.
  • Tried multiple browsers and two machines.
  • We are using Zoo Flexible Admin, and it happens when he clicks a link we setup to directly create an entry for a specified channel (again though, others use that same menu with no issues)
  • I administer about 50 EE installs and I've always been able to fix this by clearing cache, cookines, or permission issue. None of those seem to work this time.

any ideas? thanks

UPDATES based on comments below: - while navigating the control panel, I only get this while on his machines. I can log in as the user just fine

- offending url is : http://www.domainname.com/system/admin.php?/cp/content_publish/entry_form?channel_id=1

- htaccess:

#secure .htaccess file
<Files .htaccess>
  order allow,deny
  deny from all

# EE 404 page for missing pages
ErrorDocument 404 /index.php/site/404

#Block Access to directories with no index file
Options -Indexes

# Simple 404 for missing files
<FilesMatch "(\.jpe?g|gif|png|bmp|css|js|flv)$">
  ErrorDocument 404 "File Not Found"

# Although highly unlikely, your host may have +FollowSymLinks enabled at the root level, yet disallow its addition in .htaccess; in which case, adding +FollowSymLinks will break your setup (probably a 500 error), so just remove it, and your rules should work fine.
#Options +FollowSymlinks
RewriteEngine On
RewriteBase /

RewriteCond %{THE_REQUEST} ^GET
RewriteCond %{THE_REQUEST} ^[^/]*/index\.php [NC]
RewriteRule ^index\.php(.+) $1 [R=301,L]

# Add the www
RewriteCond %{HTTP_HOST} ^domainname\.com
RewriteRule ^(.*)$ http://www.domainname.com/$1 [R=permanent,L]

#Removes index.php from ExpressionEngine URLs
RewriteCond $1 !\.(gif|jpe?g|png)$ [NC]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php?/$1 [L]

#RewriteCond %{HTTP_HOST} ^(blog|news).domain.com$ [NC]
#RewriteRule ^$ %1/ [L]

2 Answers 2


Found some suggestions in the EllisLab Forums that might help.

In the system/codeigniter/system/core/input.php file:

Find the function _clean_input_keys($str)


exit(‘Disallowed Key Characters.’);


exit(‘Disallowed Key Characters.’. $str);

This will tell you what characters are causing you problems. Then you can follow the suggestions above to add them to the regex string. In my case, I just changed the input’s name.

Once you know what the offending character is you may choose to allow it.

In the system/codeigniter/system/core/input.php file see the the _clean_input_keys function to add the offending character. This may have security implications.

Other suggestion from the same source is to add a cookie prefix.

$config['cookie_prefix'] = 'im_';

  • ohh snap :) simul-posting there AllinOne :D I'll reiterate the warning hacking the core input class of CodeIgniter to allow otherwise nasty characters is not recommended! Great shout about the cookie prefix too, without it cookie's from ee (the default prefix is exp I believe) could start with _ which is disallowed!
    – Blatant
    May 8, 2015 at 17:27
  • thanks, I put the code in there. Hopefully we'll find out soon. I already prefex cookies with "exp", so I don't think the issue is there. May 8, 2015 at 17:55

From this post over on EllisLabs : https://ellislab.com/forums/viewthread/81867/

What is happening when that message displays (as you will probably know) is that there is something that is setting cookie/post/session variable with a key that contains a character in the dis-allowed list.

Are you sure there's no dodgy characters in the users username or something like that?

What you could do is apply the patch in the post above, copied below, this might tell you the string (or key) that is causing the offence at least, and help you narrow it down.

/system/codeignitor/system/core/input.php, around line 728 (on EE2.10.1) look for the below if statement and replace with the below :

if ( ! preg_match("/^[a-z0-9:_\/-]+$/i", $str))
    exit('Disallowed Key Characters. The offending key is : '.$str);

DO NOT leave this code in, it doesn't clean the offending string just echoes it so it's potentually dangerous, only use for debugging

The process of ellimination tells us it is something specific to the user, ie the user data or something in the users cookies, you tried different browsers so it's not likely to be that, perhaps you've managed to get a disallowed character into the session ID? Have you cleared the exp_sessions table and checkthe the user in quesiton (in exp_members) for anything that looks 'funky'?? I seem to recall triggering this erro when I tried to overwrite a users hashed password once...

Also see this post : https://ellislab.com/forums/viewthread/84889/ seems there can be some come-uppance with 3rd party cookies, especially if they have the dollar symbol in their key...

Edit : Update following feedback below

Ok, the string reported points to a GET parameter, from what you've posted it looks like he's calling a URL with an EE path (/cp/content_publish/entry_form) and get parameters ?channel_id).

If we put it all together with a fake domain seems he's calling your.comain.com/cp/content_publish/entry_form?channel_id. Now, if we assume your using friendly URL's (please share your .htaccess) the .htaccess will add /index.php/ to your url making your.domain.com/index.php/cp/content_publish/entry_form?channel_id, doesn't strike me as too strange however we know that what he reported is JUST the key, so we know that the parameter boundry (?) is getting applied before the path, after the domain, something like this : your.domain.com/index.php?/cp/content_publish/entry_form?channel_id=Summin

The above string makes sense in that the URL is your.domain.com/index.php then the parameter boundry, then the next part is the first 'key' (i.e. /cp/content_publish/entry_form?channel_id) and the value following the = is the value, the next parameter being split by an ampersand &. I suspect that the link being created is malformed for some reason.

What we need to see is 1. The URL being produced and 2. The URL actaully being processed. For one you'll have to ask your user to copy the link location on the link or log in as him and get it yourself (check his browser too). 2 can be taken care of with this modification in the same place as above :

if ( ! preg_match("/^[a-z0-9:_\/-]+$/i", $str))
    $port = $s['SERVER_PORT'];
    $host = empty($_SERVER['HTTP_X_FORWARDED_HOST']) : $_SERVER['http_host'] ? $_SERVER['HTTP_X_FORWARDED_HOST'] ;
    $reqUrl = "http";
    if ( !empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'on' ){
        $reqUrl .= 's://' . $host . ($port=='443' ? '' : ':' . $port);
    } else {
        $reqUrl .= '://' . $host . ($port=='80' ? '' : ':' . $port);
    $reqUrl .= $_SERVER['REQUEST_URI'];

    exit('Disallowed Key Characters. The offending key is : '.$str
    . "<br />The URL requested was : <pre>" . $reqUrl . "</pre>" );

Again, don't leave this in place, pop it in, get a test result and take it out.

Edit 2 : Following reveal of Generated URL and .htaccess

Looks like the link you're creating in the CP is not valid. Modern browsers may interfere/correct this, some browsers may not. Notice the 2 question marks in your URL??

Good news is (thanks for the extra info btw :) ) I can test this URL in my sandbox! Looks like we're missing a number of things from the URL...

Firstly is the CP Session ID, I realise you could be using the 'non' Session ID type of session type (Admin > Security & Privacy > Security and Sessions > Control Panel Session Type) however if you're default you'll need the S parameter...

Also related to this is if your user is deliberately blocking cookies, if you have Cookies Only as your CP session type and the user's blocking cookies then we've an issue.

Next, thanks again for sharing the .htaccess, but is this the .htaccess from inside the system directory?? if you look at your URL you'll see the path is /system/admin.php, ergo we're browsing a sub directory. you should have admin.php in the site root?May not be relivent against the EE version, please ignore

Finally, can you share the code that creates your link please???

Finally, regardless of all the above questions, here's my stab at creating your link, this should deal with the session variables and your 'double parameter marker' issue...

//Create link to content_publish controller, entry_form method, channel_id of 1
$urlToEntry = BASE . AMP . 
              'C=content_publish' . AMP . 
              'M=entry_form' . AMP

Try this as a 'drop in' replacement and see if you get further with it? Let us know if this changes the generated link and if it works as the other link does (it should!)

Here the BASE definition in the EE CP is the whole base URL for the CP, including the session id if applicable and the cp indicator, the rest is the MVC style of call in the CP. Tested on EE 2.7.1 & 2.10.1.

  • thanks. I edited that line. Hopefully he'll get back to me soon to see what it says. As far as the exp_sessions, there was only one row in there and that was my current session. I didn't see anything funny on his row in the members table either. I should also rephrase- that it only happens on his machines. I can log in as him all day long and not get the error. May 8, 2015 at 17:53
  • 1
    Ahh, that discounts expressionengine then, if you can log in as him there can't be anything wrong with the user. It's got to be some add on, 3rd party software or malware on his machine, I'll bet something's forcing a 3rd party cookie of some kind in there. Get your user to run angry virus and malware scan, I would say, and uninstall all the dodgy (so all) add ons... It has to be an issue with his machine, not your website
    – Blatant
    May 9, 2015 at 17:00
  • Sorry that should be anti virus not angry virus, lol. Also sorry I cant seem to edit my comments on my phone so had to add the correction here
    – Blatant
    May 9, 2015 at 17:02
  • So he cam back to me and say that the message he sees is "Disallowed Key Characters. The offending key is : /cp/content_publish/entry_form?channel_id" . So weird. I like where you are going with the anti-virus though. I'll see if I can setup a remote login session with him and check that stuff out on his machine. May 10, 2015 at 4:22
  • My vote is that the problem with that user exists between the keyboard and the chair.
    – jrothafer
    May 11, 2015 at 12:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.