Rewrite rules - going outside the docroot.

Question

Assuming the following directory structure,

htdocs/
  images/
  css/
  .htaccess
system/
  index.php
  ...

I would like to route all incoming requests through that php script. I have been trying some rewrite rules within the htaccess, but I can't seem to be able to route to files that are outside the document root. I couldn't find a reason for this in the apache manuals, so eventually resorted to "Include" an apache config file, where the rules are different.

Is there a way of rewriting outside of the docroot?

Answer 1

No, you cannot route outside the docroot without potentially enormous risk.

You should place the index.php within the htdocs folder and rewrite it there, not outside. If you were to rewrite to handle the index, accessing outside the docroot, and you made one little mistake it's potentially exploited by any hacker rewriting the request string. Not pretty!

Answer 2

What a lot of frameworks do is use rewrite to route all requests to one file where you can do more complex routing of your own. An example .htaccess file might be:

# ignore anything that's an actual file (eg CSS, js, images) 
RewriteCond %{DOCUMENT_ROOT}%{REQUEST_URI} !-f
# redirect all other traffic to the index page
RewriteRule ^.*$ index.php [L]

Where index.php is inside your doc root (htdocs/index.php) and from which you can safely include System/index.php where appropriate.