url encoding query string

[killahbeez]

Hi,

Let's say I want to forbide access to urls that contains in query_string some words (DIDI).

RewriteCond %{QUERY_STRING} !^$
RewriteCond %{QUERY_STRING} DIDI [NC]
RewriteRule . - [F]

Everything is OK with
http://www.example.com/index.html?test=DIDI,

but with didi url encode it's NOT like
http://www.example.com/index.html?test=%44%49%44%49

How can I do this without make something like
RewriteCond %{QUERY_STRING} DIDI¦%44%49%44%49 [NC]

[g1smd]

Your code wouldn't work for D%49D%49 or for DI%44%49 so I'd try to go one better...

RewriteCond %{QUERY_STRING} (D¦%44)(I¦%49)(D¦%44)(I¦%49) [NC]

.

Note also, that...

RewriteCond %{QUERY_STRING} !^$

can be replaced by...

RewriteCond %{QUERY_STRING} .

[g1smd]

Note also, that your code will not work for

www.example.com?whatever=didi or for
www.example.com/?whatever=didi

where the index filename itself is not stated in the URL.

You would need to replace . with .* in the Rule.

[killahbeez]

Thanx, so it's not a better way to deal with encodings but alternate in regex. I thought it is a way of decoding first and than apply the regexp, apparently not.

[killahbeez]

I'm right, cause the regexp will become very ugly indeed?

[g1smd]

I don't particularly care how ugly it gets, just as long as it does exactly the job I want it to do, and do it efficiently.

[killahbeez]

My questions was if there are no other solutions but that (some kind of decoding first), because the uglier it get's the more regexp engine will have to work in order to match, so for me matter.

[jdMorgan]

Any other solutions would likely involve calling a PERL script using a RewriteMap that you define in your server's config file. If you cannot 'control' whether characters in the query string are encoded, then all you can do is to make the regex as efficient as possible.

And, unfortunately, it is also possible that the query string may become multiply-encoded if copied from place to place. In that case, you'd need to allow for that as well:

RewriteCond %{QUERY_STRING} (D¦%(25)*44)(I¦%(25)*49)(D¦%(25)*44)(I¦%(25)*49) [NC]

To be clear, the plain-text character "D" is encoded as %44. If that string is re-encoded, the result is %2544 (the percent sign itself is encoded as %25). If that string is encoded again, then the result will be %252544, and so on.

Jim