.htaccess: "echo" keyword/variable is breaking the redirect

[sothis]

Hi folks,

Here's a section of code I have in my .htaccess file:

RewriteCond %{SCRIPT_FILENAME}!-f
RewriteCond %{SCRIPT_FILENAME}!-d
RewriteRule ^users/(.*)$ users/entry.php?username=$1

(this code lets users appear to have their own page, ex: http://www.example.com/users/myusername )

This code has worked perfectly in every case, until now. Someone with the name "oshecho" mentioned to me that he couldn't load up his page -- indeed, I get a Forbidden and 404 error when I try to access http://www.example.com/users/oshecho

--------------------------
Forbidden
You don't have permission to access /users/oshecho on this server.

Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.
---------------------------

(This also happens if I try /users/echo )

I'm guessing that because "echo" is a valid command in htaccess, that when the variable "oshecho" is appended on the end of the rewrite rule, it breaks the file. This is troublesome because I don't know what other words would break the rewrite rules, and don't want to have to disallow the word echo for any usernames (searching for the word echo also breaks my search functionality -- which is also set up with a rewrite rule).

Does anyone know why this is happening, and what I can do to prevent it? I don't call eval or anything in the file, so I'm not sure what I can do.

thank you!

[sothis]

A quick update...

This definitely appears to be related to "echo", as I've tested and found the following:

-<stuff>echo<other stuff> works fine
-<stuff>echo does not

so, it only seems to break if echo ends the string, which I guess would make sense. Now if only there was a way to circumvent it thinking echo is a keyword...

[jdMorgan]

This is likely mod_security blocking "echo" in the URL -- a command which can be used to inject other arbitrary commands into the OS shell -- Very dangerous.
If this were my site, I'd play dumb, apologize, and ask the user to pick a new name -- end of.

Jim

[sothis]

Ahh, thank you very much for the response. I'll prohibit echo from being used as a registered name.

Off hand, do you know of any other terms which are likely blocked? I'll go ahead and add them to the list of unallowed names, if there are more. :)

[jdMorgan]

That depends on how your host has configured mod_security; you might either want to ask them or research the default mod_security settings on the Web.

Jim