Hi,

I was recently made aware of the following page:

https://www.zen-cart.com/tutorials/i...hp?article=320

The following lines cannot be made part of the core or they will break many payment modules:

PHP Code:
if (isset($_GET[$key]) && strlen($_GET[$key]) > 43) {
    $contaminated = true;
  } 
This is because they are limiting the length of any single GET parameter to 43 characters.

Many of the payment modules pass an error message as a GET parameter which is considerably longer than 43 characters - something which is fully compliant with all relevant standards/guidelines.

Either the error_message parameter should be removed from the $paramsToCheck array or the allowed length of the parameters should conform to the web standards for GET parameters.

Obviously it would be a critical mistake to implement this code as it is in 1.3.9/2.0.0, so I hope that the above comments will be taken onboard and that Zen Cart won't break standards for overzealous "peace of mind" issues! ;)

All the best...

Conor