Mod-Rewrite or PHP router?

Question

I am debating routing my requests with one of the two options:

Option 1: simple capture route with Mod-Rewrite and funnel written $_GET route to index.php for loading...

#default routing
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule    ^blog/([0-9]+)?$    index.php?rt=blog&params=$1    [L,QSA]
// ..more custom routes, and then a default route
RewriteRule    ^([A-Za-z]+)/([A-Za-z]+)/(.*)?$    index.php?rt=$1/$2&params=$3    [L,QSA]

Option 2: simply route requests to Front Controller, and create a PHP routing class to handle the routing...

#default routing
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php?rt=$1 [L,QSA]

/* --- on front controller, process $_GET['rt'] --- */

at the end of the day, which will run faster, be easier to secure, and be easier to maintain?

any other ideas?

NOTE: I am not running a known framework. I am building my own MVC pattern to learn it.

Answer 1

Usually in MVC frameworks, this sort of thing is usually best handled by a front controller (named index.php or the like). You use mod_rewrite to then hide index.php from all of the URLs so your users see nice clean paths.

It's also way easier to handle in PHP than in Apache's rewrite directives. PHP is much more flexible and easier to write/understand. I'm not sure I've ever seen mod_rewrite used as the sole routing engine for any web framework out there, now that I think of it.

Your second snip of code is the way to go for your rewrite directives.

Answer 2

I'm doing something similar, but I have a problem:

When you go with Option 2, how would you handle the situation in which the value of $_GET['rt'] does not match any route?

Because, at this point, the URI is not a file (since mod_rewrite already checked with -d and -f) or a route.

I can do a header('Location: path/to/my/custom/404/page.php'); to redirect to a custom 404 page, but Apache will never report an error on the error logs because we are redirecting to a page that actually exists. Even if the custom 404 page specifies the HTTP code 404 via the header("HTTP/1.1 404 Not Found") code, Apache does not generate not-found error in the log.

So then, I can't log anywhere when someone tries to visit a page that does not exist (maybe it's a broken link somewhere).

Any ideas? Thanks!