Pagination and htaccess - php

Question

I am looking for some help in my htaccess to better handle my urls when using a pagination function.
Currently my htaccess looks like this:
RewriteEngine On RewriteBase /
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^([A-Za-z0-9-]+)/?$ index.php?alias=$1 [QSA,NC,L]
RewriteRule ^([A-Za-z0-9-]+)/([A-Za-z0-9-]+)/?$ index.php?alias=$1/$2 [QSA,NC,L]
basically, I have two rules. At first I only had the second one, to direct all requests to my index page, where I then parse out some details of the url in order to show the correct content. I found that it didnt work for urls with only one sub directory, like example.com/bars, but only two directories like, example.com/bars/bar-name, so I added the rule before it.
This has been working great for me. All of my urls look great and the ?alias=bars/bars-name has been completlely hidden and now looks like /bars/bars-name
Recently though I have integrated a pagination php function. This function creates urls that looks like this:
example.com/bars?alias=bars&info=mysql_table_bars&page=2
Basically, 'info' is the table name that the pagination function queries, and 'page' is the current page. It seems 'alias' also started showing in the url once I started using this function.
What I would like is for my pagination to look like these examples:
example.com/bars/page/2
example.com/hotels/page/5
etc...
What do I need to add to my htaccess to handle this situation? Also, is there a way to simplify my existing two rules?

Answer 1

Regarding your original rules. The conditions that you have only get applied to the immediately following RewriteRule, so you need to duplicate them:
RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^([A-Za-z0-9-]+)/?$ index.php?alias=$1 [QSA,NC,L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^([A-Za-z0-9-]+)/([A-Za-z0-9-]+)/?$ index.php?alias=$1/$2 [QSA,NC,L]
For the new pagination stuff, firstly, it is really bad to be pulling database table names from the query string, unless they've been validated somehow (which may be what's happening). But even then, it's still an information disclosure problem. So you can use these rules to always remove them:
# This matches the actual request when there's pagination in the query string
RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ /([^/\?]+)\?alias=([^&\ ]+)&info=.*&page=([0-9]+)
# an optional sanity check, does the request URI match the "alias" param?
RewriteCond %1:%2:%3 ^(.*):\1:(.*)$
# redirect the browser to the URL with the table name removed
RewriteRule ^ /%1/page/%2? [L,R=301]
Then you need rules to internally rewrite them back to the request with the query string:
# rewrite it back to the query string
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^/?([^/]+)/page/([0-9]+) /$1?alias=$1&info=mysql_table_$1&page=$2 [L]