I'm an amateur in php. I have a website where I load projects from a DB and for example when I want to load a proyect the url is like this
www.mywesite.com/proyecto.php?id=1
I did a .htaccess to use this url:
www.mywebsite.com/proyecto/id/1
.htaccess
<ifModule mod_rewrite.c>
Options +FollowSymLinks
RewriteEngine on
RewriteRule proyecto/id/(.*)/ proyecto.php?id=$1
RewriteRule proyecto/id/(.*) proyecto.php?id=$1
RewriteRule ^([^\.]+)$ $1.php [NC,L]
ErrorDocument 404 /error404.php
</ifModule>
The problem now is that the variables are undefined because of the change of the url I think. This is how I get the variables
$valorid = $_GET['id'];
$connection = new
PDO('mysql:host='.$host.';dbname='.$db_name.';charset=utf8',''.$username.'', ''.$password.'');
foreach($connection->query('SELECT * FROM grafica WHERE id = '.$valorid.'')
as $row) {
}
And I set the like this
<?php echo $row['nombre'] />
In regards to your question, this was already answered here: URL rewriting with PHP
In the future, please make sure to search for possible solutions. Consider the following in your .htaccess file:
<ifModule mod_rewrite.c>
Options +FollowSymLinks
RewriteEngine on
RewriteRule ^/proyecto/id/([0-9]+)/$ /proyecto.php?id=$1
RewriteRule ^([^\.]+)$ $1.php [NC,L]
ErrorDocument 404 /error404.php
</ifModule>
This is the first step to creating a more secure GET Request. For example, this will pass:
www.mywebsite.com/proyecto/id/1/
While a malicious attempt should fail:
www.mywebsite.com/proyecto/id/%5Cxbf%5Cx27%20OR%201%3D1%20%2F*
This would pass \xbf\x27 OR 1=1 /* to your script and could be potentially harmful payload. Since this value is not 0 through 9, the rewrite condition should not be met.
On to your SQL Query. This is the next level of defense, we want to ensure that we only use an integer variable type. To do this, we want to sanitize the input from the browser in some way. More than one way to do this. We can do it before passing the variable to the query or we can use PDO Functions.
Example 1: Santize the variable before Query
Instead of using:
$valorid = $_GET['id'];
Where whatever is entered as id will be placed in the variable, we can force it to be a number. Something like:
$valorid = sprintf("%d", $_GET['id']);
This is a less used method, since it's basically formatting the variable into a digit.
Example 2: Using PDO Prepared Statement
Refer to: http://php.net/manual/en/pdo.prepared-statements.php
Consider the following:
$conn = new PDO("mysql:host=$host;dbname=$db_name;charset=utf8",$username, $password);
$stmt = $conn->prepare('SELECT * FROM grafica WHERE id = ? LIMIT 1');
if ($stmt->execute(array($_GET['id']))) {
while ($row = $stmt->fetch()) {
// Do the needful
}
}
This is considered a better method. One, we have improved the statement with LIMIT 1 to ensure we only get 1 result. Two, PDO will prepare the statement and ensure that all potentially harmful elements are handled, commented, or obscured.
Prepares an SQL statement to be executed by the PDOStatement::execute() method. The SQL statement can contain zero or more named (:name) or question mark (?) parameter markers for which real values will be substituted when the statement is executed. You cannot use both named and question mark parameter markers within the same SQL statement; pick one or the other parameter style. Use these parameters to bind any user-input, do not include the user-input directly in the query.
Hope that helps.
Hello I was trying to come up with the solution to my problem, but I just was not able to. So here is my problem:
What I used was a .htaccess
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^.+(.*)/(.*)$ ./index.php?mesto=$1&den=$2 [QSA,NC,L]
It will display the url well. as www.site.com/CITY/DAY for example ../Prague/30.3.2014 but i need it to be more complex.
What I need is to have additional parameters, such as Bar or Restaurant in the url for example www-site.com/Prague/30.3.2014/p/bar/restaurant and other time I might have www-site.com/Prague/30.3.2014/p/pizza/bar
That part I have no idea how to do, because I have 5 different parameters
I imagine that the raw url would look this index.php?city=Prague&day=30.3.2014&p1=0&p2=0&p3=0&p4=0&p5=0 where p1 to p5 are the parameters being active (0 not 1 yes).
I don't understand how to detect what parameters are active and how to properly display the pretty url. Could you please help me?
Use
RewriteRule ^(.*)$ ./index.php [QSA,NC,L]
This will redirect all your requests to a single index.php that parses the uri with something like this:
<?php
// Example URI: /florence/30-06-2009
// Remove first slash from REQUEST_URI
$uri = substr($_SERVER['REQUEST_URI'],1);
// Get an array with portions between slashes.
$splittedURI = explode("/", $uri);
// Here you get your city (or anything else that you want)
$city = array_unshift($splittedURI); // In example, $city = "florence"
// Remaining itens in $splittedURI are the arguments/parameters to your page
// Like this:
$date = $splittedURI[0]; // In example, $date = "30-06-2009"
?>
Remember that this is just and example, and you should do additional verifications to avoid PHP exceptions.
If you need complicated routing (and if you sure you want to create your own router instead of using a ready solution as ZF, Symfony etc.) you're better off just passing the whole request uri to a php router object. There you can as complex router logic as you need.
So basically, loose the parsing in the rewrite rule:
RewriteRule ^(.*)$ ./index.php?route=$1 [QSA,NC,L]
Then you can let the index.php create a router object that can parse the route parameter and delegate the job where it needs to.
I'd recommend reading up about existing routing solutions though.
I am trying to use apache-rewrite rule to convert the below URL:
http://localhost/foo/bar/news.php?id=24
Into this format:
http://localhost/foo/bar/news/foo-bar
The number 24 is an id of a random row from a MySQL table, which also contains title and content fields.
MariaDB [blog]> select * from articles;
+----+---------+----------+
| id | title | content |
+----+---------+----------+
| 1 | foo-bar | bla bla |
+----+---------+----------+
1 row in set (0.00 sec)
I have the following rule inside my .htaccess:
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-l
^news/([A_Za_z0_9_]+)$ DIRECTORY/AID/news.php?id=$1 [QSA,L]
I also have a php code that generates a link like this:
$link = "<a href='news.php?id={$row['id']}'></a>";
echo $link;
However, I can't get the rewrite rule to change the path as the desired end result.
The substitution (Real) URL has a number -Code- to identify the link (According to your description): http://localhost/DIRECTORY/AID/news.php?news=42
That code is 42 in this case, but the URL you want displayed doesn't have it. Without that number, we'll get error 404 always. It's like entering only: http://localhost/DIRECTORY/AID/news.php?news=
Have to modify the URL you want displayed by adding the code after "/", for example. Could be a hyphen, etc., but the regex has to be modified accordingly.
Here is an example entering: http://localhost/news/42/ to go to http://localhost/DIRECTORY/AID/news.php?news=42:
RewriteEngine On
RewriteRule ^news/([0-9]+)/?$ DIRECTORY/AID/news.php?news=$1 [NC,L]
That's all you need. To test this example, insert this only code in news.php at http://localhost/DIRECTORY/AID/
<?php
if ( $_GET[ 'news' ] == '42' ) {
echo "HERE I AM<br /><br />";
}
?>
UPDATED according to OP description. Any name can be used instead of This_is_news:
RewriteEngine On
RewriteRule ^news/([0-9a-zA-Z-_]+)/?$ DIRECTORY/AID/news.php?news=$1 [NC,L]
First of all, you would need to change the href in the html, to give the new url format
function news_preview() {
$query = "SELECT * FROM news ORDER BY id DESC LIMIT 5 ";
$result = mysql_query($query) or die(mysql_error());
while($row=mysql_fetch_array($result))
{
echo " ". substr($row['title'], 0,26)."...<br/>".; }
}
The will generate urls like http://localhost/news/24
Note that I removed the /DIRECTORY/AID from the url, as the htaccess suggest you want that to be url, as opposed to what you stated in the text.
But now the get to the http://localhost/news/this_is_article_title type of url. Because there is no correlation between this_is_article_title and the id 24, the only way to achieve this is by either adding the id to the url too, or to have the php lookup the news-article with this title in the database.
This last solution however has some problems, as the you can't just us the title in a url. You have to escape characters. Also you'll have to add a index for the title row in the DB for better performance.
So I'll go with the first solution. We will generate urls like this
http://localhost/news/24/this_is_article_title
First the php part
function news_preview() {
$query = "SELECT * FROM news ORDER BY id DESC LIMIT 5 ";
$result = mysql_query($query) or die(mysql_error());
while($row=mysql_fetch_array($result))
{
$url = "/news/$row[id]/".preg_replace('/[^a-zA-Z0-9-_]/', '_', $row['title']);
echo " ". substr($row['title'], 0,26)."...<br/>".; }
}
Next comes the htaccess part.
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-l
RewriteRule ^news/([0-9]+)/([A-Za-z0-9_-]+)$ DIRECTORY/AID/news.php?id=$1 [QSA,L]
That should do it I think.
Place RewriteBase right after RewriteEngine On
It will set up rewrite engine correctly before you start redirecting
Unfortunately I'm unable to answer your question in PHP or Apache (although I am using a hand-rolled REST converter to create URL addresses on my current project), but from what I understand, you want your user to type out http://localhost/DIRECTORY/AID/article.php?a_id=24 and the address bar should end up like http://localhost/DIRECTORY/AID/news/this_is_article_title.
I'm not entirely sure what benefits this provides for you, and please bear in mind my solution will NOT allow your end-user to type the RESTful URL and end up at the page with the QueryString address. You'd need some extra legwork to do this, and even more legwork to keep it in sync with the DB (I'd recommend a script that deseminates the RESTFUL URL, queries the DB for the topic then returns the ID or page content ... but that's an different Stack Overflow question for another day.
SOLUTION
My proposed solution requires HTML5 doctype and a very light sprinkling of Javascript.
history.replaceState(null, "history title here", "news/this_is_article_title");
What this does is it changes the URL in the address bar without triggering a page redirect, reload or anything else. This javascript can be dynamically written with your PHP so as the page is served, the address is updated. The higher up in the document it is, the faster the change.
Here's a jsFiddle link: http://jsfiddle.net/uT3RP/1/
Unfortunately they run the code in an iframe so it doesn't control the main address bar, so I included an alert displaying what the address bar location would say, for proof. It's not the most elegant of solutions. I wouldn't even recommend doing what you're doing without the failsafes of making sure the URL displayed can be used to get to the same page. Disclaimer aside ... your problem is solved with 1 line of js and a doctype change (if you aren't using HTML5).
You can stop flogging poor ol' htaccess and get on with your project :)
This is a problem about URL-Rewrite and String-to-Id Algorithm.
Above all, please remember that what ever your url changes by rewrite module, the url in the browser bar always contains the post param like id or string(about your news).
Now to the question. Our purpose is just to rewrite the Url:
http://localhost/DIRECTORY/AID/news/this_is_article_title
to:
http://localhost/DIRECTORY/AID/news.php?a_id=24
With the rewrite module, we can only rewrite it to:
http://localhost/DIRECTORY/AID/news.php?title=this_is_article_title
and here is the htaccess part, alrealdy tested on a htaccess-online-tester
RewriteRule ^DIRECTORY/AID/news/([A-Za-z0-9_]+)$ DIRECTORY/AID/news.php?title=$1 [QSA,L]
The remaining work is build a algorithm for mapping the title to the news which rewrite module cannot help us(especially you manually rewrite the url one by one). We can use php code below:
<?php
//write url reflect to news title.
function build_news_url_by_title(){
$query = "SELECT * FROM news ORDER BY id DESC LIMIT 5";
$result = mysql_query($query) or die(mysql_error());
while($row = mysql_fetch_array($result)){
echo "".substr($row['title'], 0,26)."";
}
}
function get_news_by_title($title){
$real_title = strtr($title, "_", " ");
$query = "SELECT * FROM news WHERE title LIKE %".$real_title."% LIMIT 1";
return mysql_query($query) or die(mysql_error());
}
$title = $_POST['title'];
$news = get_news_by_title($title);
//some code return the news
...
So the url:
http://localhost/DIRECTORY/AID/news/this_is_article_title
can give us the news also.
Finally, from the steps above, if we type url
http://localhost/DIRECTORY/AID/news/this_is_article_title
in the browser bar, it can be also give us the news. And it has none bussiness about the stupid ID. And Though, there maybe some bugs with the code above, do not put it on your product server.
Can you see if this works?
RewriteEngine On
RewriteBase /DIRECTORY/AID/
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-l
^news/([A-Za-z0-9_]+)$ news.php?id=$1 [QSA,L]
EDIT : Fixed the regex character class definitions.
You are missing the title of the URL. If you wish to show that in URL, then you must include it in the link as well, like this:
<a href="news.php?news_id=$id&title=$url_tile">
This seems to be a complicated problem because you do not know where it really is doing wrong.
I would suggest you divide what you want to do into small parts and make each of them work properly before you join them together. For example:
1. Make sure .htaccess file is readable and can do some simple thing, preventing directory indexing for instance.
2. Make sure you can redirect something with simple html code.
3. Make sure you can run Felipe's example code successfully. From here you can get good picture of what is going on.
And as a side note:
It is more common to rewrite like this:
http://localhost/DIRECTORY/AID/news.php?a_id=24 TO -->
http://localhost/DIRECTORY/AID/news/24_this_is_article_title
Notice the id 24 is still carried over to the rewritten url. That will make pattern matching simpler and avoid unnecessary processing of title duplication.
Change the link:
echo " ". substr($row['title'], 0,26)."
to
echo "".$row['title'].""
That way, the link will go to news/$row['title'] instead of news.php?id=.... And now in the page DIRECOTORY/AID/news.php, you should get the id and check if it is a number OR text, and in case of text match it up with the $row['title'] and then load the page accordingly.
Notes:
This assumes that $row['title'] is unique across all other rows.
The title does not contain non HTML content, in which case you will have to URL Escape those characters.
If the title is not going to be unique then you should probably do news/{id}/{title} and then in rewrite it to DIRECTORY/AID/news.php?id={id}&title={title} and then you can base it off of the ID instead of the title.
Hope that helps.
If you feel your .htaccess file is not working as intended then this is a server configuration issue and most likely to do with the AllowOverride directive under the Apache configuration.
In your http.conf file find the section which looks something as follows:
<Directory>
Options FollowSymLinks
AllowOverride None
</Directory>
Change the AllowOverride directive to allow All.
<Directory>
Options FollowSymLinks
AllowOverride All
</Directory>
The next thing is to ensure that the mod_rewrite module is enabled for your XAMPP install. Search for the following line:
#LoadModule rewrite_module modules/mod_rewrite.so
Remove the # so it looks like so:
LoadModule rewrite_module modules/mod_rewrite.so
Restart the Apache service after saving all your changes.
Also ensure you are using the RewriteBase directive in your .htaccess configuration as follows:
RewriteEngine On
RewriteBase /DIRECTORY/AID/
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-l
^news/([A-Za-z0-9_]+)(/)?$ news.php?title=$1 [QSA,L]
The next thing is to ensure your links are pointing to the Rewrite URL. Your echo line should be something like the following:
echo " " . substr($row['title'], 0, 26) . "...<br />";
Now since you can only retrieve titles with this URL rewrite method we need to configure your PHP script accordingly to retrieve the content based on the title. If you still want to use "id" only for retrieving the record then your Rewrite URL should contain the "id" in it in some form. Typical examples of this form are:
news/the_news_title_123
news/123_the_news_title
news/123/the_news_title
I cannot comment so I have to answer.
Reading all answers and your question, it is not clear what you want. At least for me. You say, for example:
http://localhost/DIRECTORY/AID/article.php?a_id=24 to
http://localhost/DIRECTORY/AID/article/this_is_article_title
But I guess that's not quite right, unless you want
http://localhost/DIRECTORY/AID/article.php?a_id=24
to be the URL entered in the browser address bar and if so, what would be the purpose of the redirection? Finally, any visitor would have to type precisely what you don't want them to type.
My guess is that you want the friendly URL to be entered:
http://localhost/DIRECTORY/AID/article/this_is_article_title , so the question should be the other way around:
http://localhost/DIRECTORY/AID/article/this_is_article_title TO
http://localhost/DIRECTORY/AID/article.php?a_id=24
The next thing that does not seem to be clear, is what's displayed in the browser bar? The only answer is: The entered URL. No way it can show anything different.
In short: If you want http://localhost/DIRECTORY/AID/article/this_is_article_title to show in the addres bar, that's what you have to enter. The real URL, the SUBSTITUTION (http://localhost/DIRECTORY/AID/article.php?a_id=24), is never shown and is never typed. That's what redirection is for.
On the other hand, it is not clear either how the ID numbers provided by news.php are expected to be converted to strings like article/this_is_article_title. ¿Where are those strings, how many ID numbers are, what kind of algorithm or formula should be used to achieve that conversion, which of those IDs are 'root" as you mentioned in a comment and how can they be identified, etc.? You should elaborate more on this point because it seems improvised and incoherent with your previous comments.
I might be wrong, of course. I am just guessing to try to help with your question.
Please, geniuses, don't downvote this answer, read it. I am not trying to answer the question and I am really far from being a genius.
Looks like you've forgotten the slash in front of “news.php”.
I am attempting to publish a question which I know has many answers floating around Stack Overflow. However I, for some reason, just cannot seem to get the information in them to click. I will post my sources at the end of the question.
The question being, how can I pull a user_id from a URL & mod_rewrite it show the username.
Instead of this:
domain/user/index.php?user_id=1
I get this:
domain/username
I had customized other SO answers to my needs on my .htaccess file to this:
<IfModule mod_rewrite.c>
Options +FollowSymlinks
RewriteEngine On
RewriteOptions MaxRedirects=1
RewriteCond %{REQUEST_FILENAME} -f [NC,OR]
RewriteCond %{REQUEST_FILENAME} -d [NC]
RewriteRule .* - [L]
RewriteRule ^user/([^/]+)$ index.php?user_id=$1
</IfModule>
The if statement at the top of my user page looks like this:
if (isset($_GET['user_id']) || isset($_GET['username']) && queryUserId($user_id)) {
// Render Page Content
} else {
header('Location: sign_up.php');
}
And my queryUsername functions looks like this:
function queryUsername($username) {
$conn = dbConnect('read');
$sql = "SELECT * FROM users WHERE user_id = '".$username."'";
$result = $conn->query($sql) or die(mysqli_error($conn));
$row = $result->fetch_assoc();
return $row['username'];
$username = $row['username'];
}
I have successfully implemented unique URL's for users, and am accessing Account Profiles just fine when appending different user_id's to my URL, so what am I missing to get the username written to the URL instead of variable strings and folder structure?
Cheers!
Other SO Questions:
Directly adding username to URL PHP
Get username from URL in PHP
Using mod rewrite to change URL with username variable
AddedBytes Article
URL Rewriting for Beginners
This line is wrong according to your information:
RewriteRule ^user/([^/]+)$ index.php?user_id=$1
It should at least be:
RewriteRule ^user/([^/]+)$ /user/index.php?user_id=$1 // for a url like domain/user/username
or using your description:
RewriteRule ^([^/]+)$ /user/index.php?user_id=$1 // for a url like domain/username
Also, you are not setting any variable with the name of username in the code you have shown, so the check for $_GET['username'] is unnecessary.
Your check in php should look something like:
if ( isset($_GET['user_id']) && queryUserId($_GET['user_id']) ) {
Apart from that you should not use the deprecated mysql_* functions and use prepared statements as you have an sql injection problem now.
Also note that using two return statements after each other only returns the first value.
Edit: There seems to be some confusion between the user ID and the username. If the value in the url is a username, you'd better call it username in both the .htaccess file and php to avoid confusion with the user ID:
RewriteRule ^([^/]+)$ /user/index.php?username=$1 // for a url like domain/username}
and
if ( isset($_GET['username']) && queryUserName($_GET['username']) ) {
in the function (using the deprecated functions just to illustrate...):
function queryUserName($username) {
$conn = dbConnect('read');
$sql = "SELECT * FROM users WHERE username = '".$username."'";
...
}
How can I make www.mydomain.com/folder/?id=123 ---> www.mydomain.com/folder/xCkLbgGge
I want my DB query page to get it's own URL, like I've seen on twitter etc etc.
This is known as a "slug" wordpress made this term popular. Anyway though.
Ultimately what you need to do is have an .htaccess file that catches all your incoming traffic then reforms it at the server level to work with your PHP in the sense, you will still keep the ?id=123 logic intact, but to the client side '/folder/FHJKD/' will be the viewable result.
here is an example of an .htaccess file I use a similar logic on.. (so does wordpress for that matter).
RewriteEngine On
#strips the www out of the domain if there
RewriteCond %{HTTP_HOST} ^www\.domain\.com$
#applies logic that changes the domain from http://mydomain.com/post/my-article
#to resemble http://mydomain.com/?id=post/my-article
RewriteRule ^(.*)$ http://domain.com/$1 [R=301,L]
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^(.*)$ index.php?id=$1 [QSA,L]
what this will do is take everything after domain.com/ and pass it as a variable to index.php the variable in this example would be 'id' from this you have to device a logic that best suits your sites needs.
example
<?php
//the URL for the example here: http://mydomain.com/?id=post/my-article
if($_GET['id'])
{
$myParams = explode('/', $_GET['id']);
echo '<pre>';
print_r($myParams);
echo '</pre>';
}
?>
now the logic for this would have to go much deeper, this is only pure example at a basic level, but overall and especially cause your working with a database I assume, your gonna wanna make sure the $myParams is clean of malicious code, that can inject into your PHP or Database.
The output of the above $myParams via print_r() would be:
Array(
[0] => post
[1] => my-article
)
To work with it you would need to do at the very least
echo $myParams[0].'<br />';
or you could do it like this cause most browsers will add a final /
<?php
//the URL for the example here: http://mydomain.com/?id=post/my-article
if($_GET['id'])
{
//breaks the variable apart, removes any empty array values and reorders the index
$myParams = array_values(array_filter(explode('/', $_GET['id'])));
if(count($myParams > 1)
{
$sql = "SELECT * FROM post_table WHERE slug = '".mysql_real_escape_string($myParams[1])."'";
$result = mysql_query($sql);
}
}
?>
Now this admitedly is a very crude example, you would want to work some logic in there to prevent mysql injection, and then you will apply the query like you would how you are now in pulling your articles out using just id=123.
Alternatively you could also go a completely different route, and explore the wonders of MVC (Model View Control). Something like CodeIgniter is a nice easy MVC framework to get started on. But thats up to you.
This can be achieved with mod_rewrite e.g. via the .htaccess file.
In your .htacess, you need add RewriteEngine on.
After that, you will need to do some regexs to make this little beast work. I'm assuming ?id is folder.php?id=123.
For example the folder piece: RewriteRule ^folder/([a-zA-Z0-9_-]+)/([0-9]+).html$ folder.php?id=$123