QUERY STRING .htaccess problem

.htaccess QUERY_STRING RewriteCond

[phpjs]

I am using:

RewriteEngine On
RewriteBase /
RewriteCond %{QUERY_STRING} ^=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000
RewriteRule ^(.*)$ [mydomain.in...] [L]

so that anyone who enters a query string with

?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000 in it is redirected to [mydomain.in...]

but it simply redirects to the 404 error page.

Please can anyone help?

Thanks all, in advance. This forum is really cool!

[jdMorgan]

Interesting -- You should actually be getting a 500-Server error, because that rule creates an 'infinite' loop. This is because you have not removed the query string, and there is not exception to prevent a request (external or internal) for logged.php to itself.

I'd suggest:

RewriteEngine On
RewriteCond %{QUERY_STRING} ^=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000
RewriteCond $1 !^logged\.php$
RewriteRule (.*) /logged.ph[b]p?[/b] [L] 

The new RewriteCond prevents the described loop.

The "?" on the substitution URL clears the query string.

The rule syntax now specifies an internal rewrite. If you really want an external redirect, then use:

RewriteRule (.*) http://www.example.com/logged.php [R=301,L] 

"RewriteBase /" is redundant, unless you have a preceding RewriteBase directive that has set the base to some other value.

Jim

[phpjs]

Jim, thanks so much.

I dont know how you managed to work that out - way beyond me.
I REALLY appreciate such a prompt response and your kind efforts.

These days I'm really hard up but plan to subscribe/ donate when I have a little money - amazing website!

[phpjs]

Jim, could I ask you one more question please?

I have looked into the php source files (in my case version 5.2.2) and under ext/standard/ the file info.h gives:

#define PHP_LOGO_GUID"PHPE9568F34-D428-11d2-A769-00AA001ACF42"
#define PHP_EGG_LOGO_GUID"PHPE9568F36-D428-11d2-A769-00AA001ACF42"
#define ZEND_LOGO_GUID"PHPE9568F35-D428-11d2-A769-00AA001ACF42"
#define PHP_CREDITS_GUID"PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000"

So I have 4 expressions that I want to redirect with.

Will the below be ok in my .htaccess or is there a better way to do it in your opinion?

RewriteEngine On
RewriteCond %{QUERY_STRING} ^=PHPE9568F34-D428-11d2-A769-00AA001ACF42
RewriteCond $1 !^logged\.php$
RewriteRule (.*) /logged.php? [L]
RewriteCond %{QUERY_STRING} ^=PHPE9568F36-D428-11d2-A769-00AA001ACF42
RewriteCond $1 !^logged\.php$
RewriteRule (.*) /logged.php? [L]
RewriteCond %{QUERY_STRING} ^=PHPE9568F35-D428-11d2-A769-00AA001ACF42
RewriteCond $1 !^logged\.php$
RewriteRule (.*) /logged.php? [L]
RewriteCond %{QUERY_STRING} ^=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000
RewriteCond $1 !^logged\.php$
RewriteRule (.*) /logged.php? [L]

REALLY appreciate any help on this. Thanks!

[g1smd]

On any level, to have parameters like that in a URL is asking for trouble.

What happens if Google thinks that is a session ID?

What happens if someone cuts and pastes that URL as a link on their site, but cuts a few characters off the end?

I'm not sure what you're doing, but from a search-engine viewpoint it looks bad.

[phpjs]

To have parameters like what? And which url do you mean?

What I am doing is stopping people viewing php credits, versions, etc. by using a url with ?=PHPCreditExposingString... appended to the end.

If someone cuts and pastes which URL and cuts off chars? I do not understand what you mean! Please could you elaborate?

Thanks

[vincevincevince]

Just edit php.ini and change:
expose_php = On
to:
expose_php = Off

That will disable the 'easter eggs'.

[jdMorgan]

You could shorten that code significantly:

RewriteEngine on
RewriteCond $1 !^logged\.php$
RewriteCond %{QUERY_STRING} ^=PHPE9568F34-D428-11d2-A769-00AA001ACF42 [OR]
RewriteCond %{QUERY_STRING} ^=PHPE9568F36-D428-11d2-A769-00AA001ACF42 [OR]
RewriteCond %{QUERY_STRING} ^=PHPE9568F35-D428-11d2-A769-00AA001ACF42 [OR]
RewriteCond %{QUERY_STRING} ^=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000
RewriteRule (.*) /logged.php? [L]

or, if the list of GUIDs is not subject to on-going change or maintenance:

RewriteEngine on
RewriteCond $1 !^logged\.php$
RewriteCond %{QUERY_STRING} ^=PHPE9568F3[b][456][/b]-D428-11d2-A769-00AA001ACF42 [OR]
RewriteCond %{QUERY_STRING} ^=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000
RewriteRule (.*) /logged.php? [L]

Jim

[phpjs]

vince x 3,
I'm running php 5.2.2 on shared hosting. expose_php = Off seems to work but doesnt disable easter eggs in my case. Perhaps you are running different version? Thanks for the tip though, its important for security!

Hi Jim. Thanks for an amazing bit of code once again. Sorry I have 2 final questions.

1. How long have you been developing for?
2. I am writing an article on web security. Would it be ok to quote you?
I will provide a link to this page and a credit to jdMorgan (Jim) at webmasterworld? Regardless of whether you say yes or no I will be recommending that users join this website - really helpful is an understatement.

Hi g1smd!
If you read this message anytime, I'd be really grateful to know what you mean as I am not very knowledgeable about search engines.

THANKS ALL!

[jdMorgan]

1. Depends on what kind of development you're asking about, but in any case the answer ranges from eight years to three decades.
2. Quote me on what? Do mind the WebmasterWorld Copyright notice, please...

Jim

[phpjs]

I meant web developing, software developing, IT in general. You seem really skilled, thats why I ask.

I am working on a circa 10,000 word security article, generally PHP but including other considerations.

What I wanted to quote was the block of .htaccess code (the first and the last that you provided on this page) because it's properly written and I am not as advanced as you with .htaccess.

If you say yes, tell me what detail you want included/ excluded and please dont worry - I'll take permission from the site owners too before doing anything otherwise prohibited so noone has any problems.

A big THANK YOU!