Matching a filename pattern

Trying to secure a php script with htaccess and php

[Red5]

Hi,

I have a php file in it's own directory that can be validly called using a number (any decimal number) as the filename, followed by .html (eg: 123.html or 12345678790.html).

The top-level .htaccess file currently contains the following line:

RewriteRule ^dirname/([0-9]*)\.html /dirname/file.php?id=$1 [L,NC]

In the php script itself, I use the follwing lines to check for valid filenames:

if(!preg_match("/\.html$/", $currentRequestedFile))
{
header("HTTP/1.0 404 Not Found");
include($_SERVER['DOCUMENT_ROOT'].'/404.php');
exit;
}

My problem is that it serves the script with both of the following urls:

www.example.com/dirname/12345.html (correct)
www.example.com/dirname/12345.html.html (incorrect)

What's the best way of ensuring that the script only serves pages when an exact pattern match occurs (ie, the correct example above)?

Many thanks. :-)

[jdMorgan]

You need to end-anchor the pattern:

RewriteRule ^dirname/([0-9]+)\.ht[b]ml$[/b] /dirname/file.php?id=$1 [L,NC]

Jim

[Red5]

Thanks for the answer and your promptness Jim. I guess I can do without that preg_match nonsense now. :-)