Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to limit which characters can be used in the request URI using:

RewriteEngine on

RewriteCond %{REQUEST_URI} !^([a-z0-9\:\/\.\_\-]) [NC]

RewriteRule ^.* - [F,L]

For some reason it's not working. Any ideas?


share|improve this question
Rather than creating that sort of filter yourself you might want to take a look at mod_security ( – joschi Dec 10 '10 at 12:04
up vote 2 down vote accepted

Nice question. A good way to protect against XSS (cross site scripting).

This is the solution:

            RewriteEngine on
            RewriteCond %{REQUEST_URI} [^a-z0-9\_\:\/\.\-] [NC]
            RewriteRule () - [F,L]

A shorter equivalent would be:

            RewriteEngine on
            RewriteRule [^a-z0-9\_\:\/\.\-] - [F,L]
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.