Q:

EE 1.7.0 cookie and login issue (disallowed key characters)

Quite out of the blue on a client site running 1.7.0, all pages loaded after the initial visit rendered the dreaded "Disallowed Key Characters" message.
Upon some investigation, I determined it was the exp_tracker cookie that was triggering this. Its value is being set to a%3A1%3A%7Bi%3A0%3Bs%3A5%3A%22index%22%3B%7D (as an example), which is not passing the Input class' clean_input_keys() function, triggering the error.
So, why this crazy value for the exp_tracker cookie, and why all-of-a-sudden? It continues to get set like this. For now my fix is to comment-out the filtering of the $_COOKIE array.
But, possibly related, I can also no longer login to the control panel - with or without the cookie filtering removed. I log-in, my session ID is set, but I just immediately return to the login screen, no error.
Are these related? Anyone seen this before?

A:

This ended up being resolved via EllisLab support:

I'm fairly sure the Suhosin Extension installed on your PHP installation is running the cookie values, or HTTP headers as a whole, through a filter and potentially removing anything that looks suspicious (like encoded semicolons) and it's also filtering the whitespace as we can see from the inserted underscores.

A support request to the host (Dreamhost) resolved this.

