Strange URLs

[Tourex]

This one is driving me nuts.

I administer a large site mainly consisting of php pages. Error messages are handled by custom pages, which also email me the essential problem so I can fix navigation and other problems.

For the past couple of weeks we keep getting Error 404 messages indicating that 'strange' page addresses are being requested from links within other pages of the site. For example:

/%E2%80%9Dsupport.php

Has anyone please got any idea what the '%E2%80%9D' might be and how it could be creeping in?

Thank you.

[chriswragg]

The %80 is the Hexidecimal code for special symbols that are in URLs. The browser automatically converts a special character in to this code if it exists in the URL.

In this URL:
%E2 means â
%80 means €
and %9D does not mean anything
(Not in ISO-8859-1 encoding anyway)

Could this strange url could be a dodgy coded link perhaps?

No idea otherwise

[Tourex]

Thanks

I had assumed they were hex but the explanation makes it even stranger, because its all meaningless. The URLs are hard-coded into the pages, or in columns in MySQL database records and have been checked carefully. All of them are in the format of '/#*$!xx.php' and none have a break between the forward slash and page name where anything could be inserted. The annoying thing is that I am unable to reproduce the condition, so haven't been able to capture a page and study the source, but I've now had about 20 error-404 messages with the condition.

Anyway, thanks for your input.

[jatar_k]

do you have any referers for those requests?

[Tourex]

In every case the refer is one of our own pages - that's why I am so puzzled.

[FiRe]

Looks like someone is trying to exploit your site!
Try using something like this:

if (ereg("[^A-Za-z0-9]", $url)) {
die("Bad URL!");
}

[jatar_k]

that is strange, trouble is with out being able to reproduce it there isn't much you can do.

I am assuming there are no patterns

all coming from a specific page or all trouble with the same link? maybe there is a bit of garbage in the row in mysql. I have had that happen and not been able to see it but when I have edited the value and simply reinserted it the problem went away.

[chriswragg]

Just so as you could avoid the 404 errors, you could use Apache ModRewrite to redirect any URLs like those you are getting to the correct one.

I beleive something might this might work, but I'm not an expert so you may want some help from the Apache Forum.

Options +FollowSymlinks
RewriteEngine on
RewriteCond %{HTTP_HOST} ^example\.com
RewriteRule ^/(.*)support.php http://example.com/support.php [R=301]

[Tourex]

Its always to two specific pages and the hex is always the same. Other than that, there's no pattern.

[Tourex]

Thanks Chris - I'll give that a try