urlencoded Forward slash is breaking URL

by

Apache denies all URLs with %2F in the path part, for security reasons: scripts can’t normally (ie. without rewriting) tell the difference between %2F and / due to the PATH_INFO environment variable being automatically URL-decoded (which is stupid, but a long-standing part of the CGI specification so there’s nothing can be done about it).

You can turn this feature off using the AllowEncodedSlashes directive, but note that other web servers will still disallow it (with no option to turn that off), and that other characters may also be taboo (eg. %5C), and that %00 in particular will always be blocked by both Apache and IIS. So if your application relied on being able to have %2F or other characters in a path part you’d be limiting your compatibility/deployment options.

I am using urlencode() while preparing the search URL

You should use rawurlencode(), not urlencode() for escaping path parts. urlencode() is misnamed, it is actually for application/x-www-form-urlencoded data such as in the query string or the body of a POST request, and not for other parts of the URL.

The difference is that + doesn’t mean space in path parts. rawurlencode() will correctly produce %20 instead, which will work both in form-encoded data and other parts of the URL.

More Related Contents:

  1. .htaccess mod_rewrite – how to exclude directory from rewrite rule
  2. Remove .php extensions with .htaccess without breaking DirectoryIndex
  3. htaccess rewrite breaks relative paths
  4. Rewrite URL after redirecting 404 error htaccess
  5. .htaccess not working on localhost with XAMPP
  6. How to remove index.php from URLs?
  7. htaccess code to remove extension AND add+force trailing slash?
  8. Using mod rewrite to change URL with username variable
  9. Preserve HTTP/HTTPS protocol in .htaccess redirects
  10. URL rewrite with .htaccess for wildcard domain
  11. URL rewriting with PHP
  12. Access-Control-Allow-Origin Multiple Origin Domains?
  13. How does RewriteBase work in .htaccess
  14. How to check whether mod_rewrite is enable on server?
  15. Header set Access-Control-Allow-Origin in .htaccess doesn’t work
  16. symfony2 rewrite rules .htaccess app.php
  17. Password protecting a directory and all of it’s subfolders using .htaccess
  18. Force HTTPS for specific URL
  19. How to Block Iframe call
  20. What does $1 [QSA,L] mean in my .htaccess file?
  21. What is L in [QSA, L] in htaccess
  22. .htaccess, proper rewriting of directory and file with same name
  23. htaccess 301 redirect – Remove query string (QSA)
  24. .htaccess to redirect images
  25. How to use .htaccess in WAMP Server?
  26. .htaccess 301 redirect for all https to http EXCEPT ONE PAGE
  27. How to Block an IP address range using the .htaccess file
  28. How to exclude a specific file from a rewriterule
  29. Reference capture groups of multiple RewriteCond in RewriteRule
  30. Using regular expression in htaccess for 301 redirects

Leave a Comment