Posting new Post leads to blank php screen

Ok, I have confirmed that the problem has to be in the database. I set up a fresh, clean, empty database and pointed the config file to it. It worked absolutely perfect.

So now I have to figure out if the problem is with the structure of the database, or if it lies in one of the posts somehow.

Wow, so, something is appending long strings of hidden spam links to the end of posts. Im betting that this is pushing the posts past readheads limit, and causing the blank page.

But what could be appending the spam? I have all plugins pulled out… and a most recent isntall of 2.5 in place.

Hmmm… this is getting more interesting…

I got it. At least, I found out what was causing this for me.

I was getting close in my last post, but it wasn’t that spam was being appended… it was that there was a spam active_plugins item in the options table.

There was a nefarious active_plugin in the database. It looked something like this: a:1:{s:5:./././././././././././././././././././././tmp/upl52653.jpg

The post.php file calls wp-settings.php which tries to cycle through all of the active plugins. When it hit that one, it broke down. Once I pulled that entry out of the database, it is working great.

Now, im pretty sure this entry was the result of a site compromise, because that filename just happens to match the title of a couple of spam posts that I also dug up. They had that jpg name as the title, and hundreds of spam links in a left: -2227px top: -3337px
div.

In looking around, it seems that hack could have been the result of an exploit in the 2.0 version of WordPress that was installed at the time. Im hoping that with 2.5, this security issue will no longer be a risk.

SO, this solved my problem, I hope it solves yours: Look in your wp_settings table for any active_plugins that don’t look right and remove them.

I hope this helps!

Brad

Excellent work, indie. I was having the same problem (on a WP install running 2.0.x).

I’ve been trying to figure this out for the past few days and this is a very valuable thread. A lot of people are looking for this solution, so hopefully the guy who originally opened it will mark it as solved.

For people running 2.0 who aren’t going to upgrade (for whatever reason), you’ll find the culprit in wp_options -> option_value

Of course, you’ll be open to this attack again until you upgrade…

Thanks for all of your work on this.

I just wanted to pipe up to clarify…
in my case *once* the blank screen happened, EVERYTHING led to a blank screen – short post, long post, edit post. Anything that called on post.php

The only way to recover and be able to post/troubleshoot again was to restore the database from a previous backup.

I also wanted to mention that I had a
:./././././././././././././././././././././tmp/*****.txt
problem in 2.0 when the first blank screen happened. I restored the database at that time, then upgraded to 2.5, but was still having the blank screen in 2.5 despite that previous ‘fix’ – I was using an imported/upgraded database (a working one from 2.0).

I think that is where it is related to the post being too long. Seems you should have a character-counter or just get a message that the post is too long… LOL

im having the same issues here.

first thing this morning, all our plug-ins had magically been deactivated. next thing i know, we cant publish or save posts. get the blank screen.

upgraded to 2.5 to see if it fixes it – but no avail.

im in the database at the mo, but cant find the wp-settings table that indie bookman mentioned.

can anyone tell me exactly where it is. some real basic instructions would help.

thanks!!

Me too. Can’t find the wp-settings table. Ack.

This is frustrating.

I also can’t get anything to post no matter length, type, characters, photos.

^sorted it!

you need to edit the wp-options. it was in there on the first page of results for me.

indie bookman, I think I love you. Thank you so much for this, solved my problem!

Stupid spam…

I also love indie bookman. I was losing what little bit of hair was still on my head. Thanks! I’m back in the saddle…

also, kudus to red sneaker who sent me here from my forum post!

Alright…I seem to be having the same problem. However, I don’t have a current database backup. Can I edit the existing database to fix?

What I have found is several entries linking to flickr.com account pages that i have never heard of. Would this be the culprit? Can I just delete those records?

Can I edit the existing database to fix? That’s what I did.

What I have found is several entries linking to flickr.com account pages that i have never heard of. Would this be the culprit? Can I just delete those records? Mine was in the wp-options database and was an “active-plugin.” Deleting it fixed all things…

Here is one of the entries:

129;”0″;”rss_cd7ad3c15d6ae5c195015b4a3acdf44c”;”O:9:\”magpierss\”:18:{s:6:\”parser\”;i:0;s:12:\”current_item\”;a:0:{}s:5:\”items\”;a:20:{i:0;a:9:{s:5:\”title\”;s:10:\”03-0523-20\”;s:4:\”link\”;s:50:\”https://www.flickr.com/photos/wangyangzh/428270289/\”;s:11:\”description\”;s:332:\”<p>wangyangzh posted a photo:</p><p><img src=\”https://farm1.static.flickr.com/152/428270289_f05e1a7910_m.jpg\” width=\”180\” height=\”240\” alt=\”03-0523-20\” style=\”border: 1px solid #ddd;\” /></p>\”;s:7:\”pubdate\”;s:31:\”Tue 20 Mar 2007 10:16:38 -0800\”;s:2:\”dc\”;a:1:{s:10:\”date.taken\”;s:25:\”2007-03-20T10:16:38-08:00\”;}s:6:\”author\”;s:30:\”[email protected] (wangyangzh)\”;s:4:\”guid\”;s:36:\”tag:flickr.com …..

and it goes on and on. I have three entries like this. How can I know this is the problem?

I’m in my options database for the blog in question that is giving me the same problems that you folks all describe. I have no idea what I’m looking at or looking for to delete. My wp_options database table for this blog is a collection of tables with titles like “Field” “Type” “Collation” and entries like “option_id” and “bigint(20)”
There is also a table called “Row Statistics” and “Indexes” but I don’t recognize anything that looks like it’s spam-ish or deletable.
The “option_value” gives me several entries, one of which begins with:

a:5:{s:13:”administrator”;a:2:{s:4:”name”;s:13:”Administrator”;s:12:”capabilities”;a:53:{s:13:”sw

Is this what I’m looking to kill? If not, can anyone explain this a bit?
thanks