forward slashes at the end of .php file extension

forward slashes php file extension

[understory]

Just a quick question: how can you prevent forward slashes after a php extension in a url?

For example:

Correct url: http://www.example.com/about.php

User enters:

http://www.example.com/about.php/

or

http://www.example.com/about.php//

or

http://www.example.com/about.php///////

I don't think it causes any breach in security... just curious why this doesn't behave as a 404. Very peculiar.

Thanks!

[edited by: encyclo at 10:45 pm (utc) on July 8, 2009]
[edit reason] switched to example.com [/edit]

[andrewsmd]

Because / is not an invalid url. You should leave it because that can cause confusion for lot's of users. A prime example for you to look at is to go here.
[webmasterworld.com...]
That is the webmasters link to the php forum but it is invalid. A regular user would think they have the wrong link
but if you go here
[webmasterworld.com...] then it goes to the correct forum. From a personal standpoint, that's annoying. I would leave it the way you have it.

[rocknbil]

Welcome aboard understory, see TOS #13 [webmasterworld.com] . . . .

just curious why this doesn't behave as a 404.

I think . . . it should. I just tested three sites with trailing slashes after the file name. Andrew's case is a little different, see below.

Samples, FireFox Live headers says:

GET /index.html/// HTTP/1.1
HTTP/1.x 404 Not Found

GET /dfgdfg.php/ HTTP/1.1
HTTP/1.x 404 Not Found

GET /cgi-bin/blah.cgi// HTTP/1.1
HTTP/1.x 200 404 Not Found

All three of these sites use dynamic output for HTML, and have .htaccess directives for non-files/directories (if !-d and if !-f) so they output custom pages based on the results. The headers are still 404's.

The problem is/should be that file.php/// is the requested filename, since it doesn't exist, it's a 404. So I'm casting my vote for something goofy in your server configuration, either via the configuration or an incorrect .htaccess directive.

In andrew's case he is referencing a directory, which is different and my guess is that's still a server configuration, either by design or by error. It's apples and oranges. When you request

/domain/directory

Directory indexing comes into play; if directory indexing is off and there's no index.html in /directory, what you should get is "permission denied." I just tested this also on other servers, response to the presence or absence of the trailing slash for a directory depends on the server configuration. For example, I may intentionally not have a directory "directory" but in my .htaccess file create a rule that if /directory (or /directory/) is requested it is rewritten to a script to look up "directory" in a database.

I'm guessing the example shown for this web site is a server configuration, whether it's by design or error only Brett will know.

[understory]

Welcome aboard understory, see TOS #13 . . . .

My apologies for the unintentional spamming. I tried to edit my message, but unfortunately my edit time had passed. If an admin feels that it's necessary, please change my post above.

So I'm casting my vote for something goofy in your server configuration, either via the configuration or an incorrect .htaccess directive.

I'll try playing with my htaccess and see what happens... I'm not really worried about users visiting the site and going to index.php/ or index.php///. I'm just curious why things are behaving the way they are.

I've actually tried whatever.php/ on a couple different sites, and the following has happened:
1. 404
2. redirect
3. the page remains the same
4. the page remains the same with some content missing

Thanks very much for your responses!

[encyclo]

Welcome to WebmasterWorld understory - one possibility is that you have content-negotiation (MultiViews) enabled. Try adding the following line to a root-level .htaccess file:

Options -MultiViews

See if that makes a difference. :)

[understory]

Options -MultiViews

No luck with this.

I've tried playing around with a few things in the .htaccess, but without any success so far.

[andrewsmd]

Sorry I should have been more clear. That is absolutely something in your server configuration. We run IIS so I always set them up to send anything with extra /s back to the root of the last folder. To me that is just easier for users to navigate to. If you want to make them invalid you would need to change something with your server configuration. I can't tell you what that would be for apache though, only IIS.