Regular expression not working in .htaccess

Question

I'm trying to limit which characters can be used in the request URI using:

RewriteEngine on


RewriteCond %{REQUEST_URI} !^([a-z0-9\:\/\.\_\-]) [NC]

RewriteRule ^.* - [F,L]

For some reason it's not working. Any ideas?

Thanks!

Answer 1

Nice question. A good way to protect against XSS (cross site scripting).

This is the solution:

            RewriteEngine on
            RewriteCond %{REQUEST_URI} [^a-z0-9\_\:\/\.\-] [NC]
            RewriteRule () - [F,L]

A shorter equivalent would be:

            RewriteEngine on
            RewriteRule [^a-z0-9\_\:\/\.\-] - [F,L]