Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to limit which characters can be used in the request URI using:

RewriteEngine on

RewriteCond %{REQUEST_URI} !^([a-z0-9\:\/\.\_\-]) [NC]

RewriteRule ^.* - [F,L]

For some reason it's not working. Any ideas?

Thanks!

share|improve this question
    
Rather than creating that sort of filter yourself you might want to take a look at mod_security (modsecurity.org). –  joschi Dec 10 '10 at 12:04
add comment

1 Answer

up vote 2 down vote accepted
+50

Nice question. A good way to protect against XSS (cross site scripting).

This is the solution:

            RewriteEngine on
            RewriteCond %{REQUEST_URI} [^a-z0-9\_\:\/\.\-] [NC]
            RewriteRule () - [F,L]

A shorter equivalent would be:

            RewriteEngine on
            RewriteRule [^a-z0-9\_\:\/\.\-] - [F,L]
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.