Is it still secure to have urls like:
http://www.website.eu/product.php?id_product=916
If not, what are security cons?
Can someone please point me a link on updated information about this practice regarding security.
Thank you
There's no security cons as far as I know. As long as your code sanitises all user input and you don't leak sensitive info like file paths or queries when an error occurs, you should be fine. Just be sure to block all access to directories where users should not be, such as your libraries or configuration directories.
The most basic thing that you can do here is convert this to lofical URL instead of a physical URL which it is right now.
physical URL - http://www.website.eu/product.php?id_product=916
Logical URL - http://www.website.eu/product/916
This would expose only the needed things and not the complete implementation style of the code.
To do this you will have to make some minor changes to the .htaccess file of the folder where product.php is present.
RewriteEngine on
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME}\.php -f
RewriteRule ^product/$ product.php?product_id=$1 [NC]
Related
With a API I'm trying to make in PHP I currently have these rewrite rules setup in the .htaccess file for the root directory of the API:
# Remove the php extension from the filename
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^([^\.]+)$ $1.php [NC,L]
This is so that requests to the API appear more "RESTful" - so instead of api/entity.php?id=5 it would be api/entity?id=5 - I'd like to go a step further though, and allow a request URL like api/entity/5 to successfully rewrite to api/entity.php/5 or api/entity.php?id=5.
I was experimenting with an apache rewrite rule something like this, where it has regex to detect a path like entity/{any number here}
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^([^\.]+)$ $1.php [NC]
RewriteRule ^(.+)(\/\d+)$ $1.php$2 [NC,L]
Where it would match entity/5 in two captures with entity and /5 and would then internally direct that to entity.php/5 - at which point in the php file I could do an explode on the request URI or something similar to that to get the value from the path.
But I don't really know enough about apache rewrites to fully implement this, as this rule doesn't work for whichever reason. I'm aware I could write hardcoded rewrite rules for each directory I would like to behave like this, but I'd really rather keep this generic.
If there is no real way to achieve what I want to here, then I'd rather just stick to paths like api/entity?id=5 than need to write a whole bunch of rewrite rules.
I was thinking as well, if there is a way to detect when a request doesn't match a directory (which would be what happens by default with a path like api/entity/5?) - it runs a different rewrite in this case - without running the first and causing it to try and write the now internally pointed URL, but again, I'm not sure how to go about implementing this.
Can someone with more experience point me in the right direction?
As Chris Hass highlighted, in this case implementing a PHP router of some variation probably makes more sense and is just easier.
Here are links to some examples I found for anyone in the future who stumbles onto this:
https://medium.com/the-andela-way/how-to-build-a-basic-server-side-routing-system-in-php-e52e613cf241
https://www.taniarascia.com/the-simplest-php-router/
https://www.educative.io/edpresso/how-to-create-a-basic-php-router
Obviously, if you're not intentionally using just PHP on its own like me, there's no reason you couldn't use a library or do this with Laravel etc to make your life even easier, why reinvent the wheel after all?
I've been searching lot of related tutorials and so on from Google to solve this on my own, but with zero luck. Therefore I am here to ask. I am trying to 'prettify' my project URL by rewriting. I am not sure are these all achievable anyhow, because I am just starting to get my head around the subject.
I am working 'example' on localhost project folder localhost/example. File '.htaccess' is located in that folder. Where I have set the following:
RewriteEngine On
RewriteBase /example
So basically my application now generates a URL consisting at least 1 parameter all the time and another pointing current location.
Current URL: localhost/example/admin.php?e=2&p=frontpage
Fantasy: localhost/example/admin/2/frontpage
About the parameters:
p stands for selected page
e stands for event
Okay lets think this all is achievable easily, do I have to change all the attributes to match current shown url?
Now they are:
href="?e=2&p=settings"
Should they be:
href="2/settings" ?
I am checking what value GET parameter P has, then including that page into content area.
That is pretty much it, pretty too complex for me, but for education purposes I really want to understand this thru and thru. Thank you.
EDIT:
With the added
RewriteRule ^admin.php/(.*)$ /admin.php?e=$1 [L,QSA]
I am getting lot of pathing errors, whole site is without styling and js files.
EDIT 2:
RewriteEngine On
RewriteBase /example
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule /admin.php/e=?(.*)$/p=?(.*)$ /admin.php?e=$1?p=$2 [L,QSA]
Now urls are following:
http://localhost/example/admin.php/2/inc/vex/vex.css
http://localhost/example/admin.php/2/css/modestgrid.css
It is not showing the page in url and the paths are not correct.
They should be http://localhost/example/admin.php/css/modestgrid.css
Your question is a bit vague, contradictory and it is unclear how you actually want to handle (reference) your asset files. But in general I'd say this should be a starting point to get you going:
RewriteEngine On
RewriteBase /example
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^([^/]+)/([^/]+)/(.*)$ $1.php?e=$2&p=$3 [END]
For this to work you obviously need the apache rewriting module to be installed and loaded, you need to take care that the interpretation of dynamic configuration files is enabled at all (AllowOverride directive) and you have to place such file in the correct location with reading permission for the http server process.
In case you get an internal server error (http status 500) for that chances are that you operate a very old version of the apache http server. In that case you probably need to replace the [END] flag with the [L] flag which probably will work here too. You will find a hint on that in your http servers error log file in that case.
And a general hint: you should always prefer to place such rules inside the http servers (virtual) host configuration instead of using dynamic configuration files (.htaccess style files). Those files are notoriously error prone, hard to debug and they really slow down the server. They are only supported as a last option for situations where you do not have control over the host configuration (read: really cheap hosting service providers) or if you have an application that relies on writing its own rewrite rules (which is an obvious security nightmare).
This is my URL
http://www.example.com/details.php?id=12&page=120.v2013-09-18.by.Acme
My htaccess script
RewriteEngine On
RewriteRule ^details/([^/]*)/([^/]*)\.html$ /details.php?id=$1&post=$2 [L]
I need to get my URL to
http://www.example.com/details/12/120.v2013-09-18.by.Acme.html
how can i change my url to above format. Please help me.
You need another rule to redirect old url to pretty URL:
Options -MultiViews
RewriteEngine On
RewriteBase /
RewriteCond %{THE_REQUEST} /details\.php\?id=([^\s&]+)&post=([^\s&]+)\s [NC]
RewriteRule ^ /detail/%1/%2? [R=302,L,NE]
RewriteRule ^details/([^/]+)/([^.]+)\.html$ details.php?id=$1&post=$2 [L,QSA,NC]
Someone very smart once said, instead of giving a fish to a hungry man, it is better to teach him how to fish. So I won't give you the exact solution. However, I have few tips for you.
Start with some small and easy snippet from a tutorial, that definitely works. If you can make it work on your server, then you can modify it step by step to your desired form.
If you cannot make it work, make sure, you have mod_rewrite enabled on your server. You can google easily how to do that. However, some hostings might not allow you to do this at all.
It is actually possible to have cool URL even without .htaccess and mod_rewrite. Check this answer out.
Know that there are some already prepared solutions for cool urls, most PHP frameworks has them. Actually, doing any web page without any framework is a pain in the ass. You can try e.g. Laravel (seems to be the most popular one nowadays). I am using Nette and I would never ever do webpage without it again.
I currently run a site with 750 pages of .html webpages (yeah I know it was a stupid idea, but I'm a novice). I'm looking to move these to php. I don't really want to set up 750 individual 301 redirects and rewrite each page to .php
I've heard that I can use htaccess to this. Anyone know how?
A few additional questions -
Can I permanently redirect these links from html to php without losing my search engine rankings and
if I want to add php to each of the files (i.e. a php file menu (using the include command) to make the links quicker to update will this work? Because won't they still be html files?
Sorry for the stupid questions, but I'm still learning.
Congratulations on a 750 page site - you must have put some work into that.
To collect your current list of pages use a tool called xenu to create an export into excel. You can then easily change the name the files to PHP in column b and create a .htaccees file.
However why would you want 750 php files? If you have lots of data pages, make it one page and suck in the HTML main content and reference one page. If you have a page called warehouse-depot-22-row-44.html then change that to show-warehouse-row.php?depot=22&row=44 and return that content only. This will significantly reduce your number of pages and to start using databases to render the content.
For redirecting you could use the Apache Module mod_rewrite: https://httpd.apache.org/docs/current/mod/mod_rewrite.html
You can use url rewriting to match a specific file name request with a regular expression and then decide where to redirect if matched
RewriteRule ^myname/?$ myname.php [NC,L]
http://www.addedbytes.com/articles/for-beginners/url-rewriting-for-beginners/
Depends on the structure you have.
You want the user to access them in their natural location?
/public_html/folder1/file.php
user would access like
mydomain.com/folder1/file
or you want to map them differently?
Personally I think I would use a rewrite rule to map all requests to my /public_html/index.php and would map the requests from there using php (using include for instance). This gives great flexibility, plus you have a single point of entry for your application which is very beneficial since you can easily maintain control of the application flow.
The .htaccess would look like this
#
# Redirect all to index.php
#
RewriteEngine On
# if a directory or a file exists, use it directly
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
# RewriteCond %{REQUEST_URI} !^/index\.php
# RewriteCond %{REQUEST_URI} (/[^.]*|\.(php|html?))$ [NC]
RewriteCond %{REQUEST_URI} (/[^.]*|\.)$ [NC]
RewriteRule .* index.php [L]
of course I place all my not directly accessible files (everything except index and css, js, images, etc) to a folder outside the public_html to ensure no user can ever access them directly ;)
I've had a similar (yet much much smaller) site that went through the same thing.
I have this in my .htaccess:
RewriteEngine On
RewriteRule ^(.*)\.html$ $1.php [L]
This will help redirect any visitors to your .html addresses to your .php addresses.
You hopefully have an IDE (I recommend Aptana), and you can use some of the find/change functions project-wide, and hopefully with some time and patience get your internal links from .html to .php.
But, I caution you a little bit - Perhaps it is time to look into a database based CMS, such as Wordpress or Drupal?
Is there a way to hide the fact that I'm using PHP from my users? I wanted to do this for two reasons:
1) So the links in the address bar look cleaner (like here on stackoverflow)
2) To prevent potential hackers of knowing immediately what to look for
Is point 2 even realistic or will a hacker know what I'm using anyway? I'm using nginx with php5-fpm.
RewriteEngine on
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME}\.php -f
RewriteRule ^(.*)$ $1.php
http://eisabainyo.net/weblog/2007/08/19/removing-file-extension-via-htaccess/
In addition to the mod_rewrite changes, also set expose_php to false: http://www.php.net/manual/en/ini.core.php#ini.expose-php
The above (or perhaps below) answers give info on the technical side, let me answer the moral side:
Don't do it. Point 2 is completely invalid, if someone wants to do harm, this won't stop it. Proper security checks however will. Point 1 is meagerly valid, no one types links anymore these days.
The best way to keep your PHP hidden from public access is to structure your folders accordingly. Best practice is to keep your library and application files at least one level up from the public folder, like:
/application
// application files
/library
// library and vendor files
/public (aka public_html, htdocs etc)
index.php
.htaccess
/css
/images
/js
Use htaccess and mod_rewrite to route requests to the index.php file, which will then dispatch the request to the application.
RewriteEngine on
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^(.*)$ index.php
This way, you only have a single php file publicly accessible, which merely includes other files not available via any url
1) So the links in the address bar look cleaner (like here on stackoverflow)
mmm. OK
2) To prevent potential hackers of knowing immediately what to look for
Security by obscurity. Trust me, that's not going to slow them down much.
A very valid reason for doing this, however, is so that your website is not tie to a particular development language.
I see several people have already mentioned mod_rewrite. It's one solution - but it's a very complex tool to master. Also, be very careful about embedding CGI variables in the path of the URL - you can quickly break stuff.
A simple solution would be to implement every entry-point php script (i.e. anything with is not an include/require file) as 'index.php' and reference it by it's directory.
Alternatively pick your own file extension and replace the references to .php in the config with your extension.