Remove IP address from Query String using HTACCESS

Question

I have a URL like so:

http://example.com/one/?ACT=123&gateway=mygateway&method=mymethod&orderID=303&currency=EUR&amount=11&PM=CreditCard&ACCEPTANCE=test123&STATUS=9&CARDNO=XXXXXXXXXXXX1111&ED=0517&CN=Test+test&TRXDATE=08%2F12%2F10&PAYID=7963938&NCERROR=0&BRAND=VISA&ECI=7&COMPLUS=q5up5h9i6clkkpsntdmupijpl5&IP=169%2E59%2E201%2E137&SHASIGN=1E02A96814AF21FD5415A285FB51A46DFCD6EF4D

I'm trying to remove the following query variable from the query string in the URL IP=169%2E59%2E201%2E137 while leaving the rest of the string intact. That variable is an IP address which may be a different IP address each time, but will always be an IP. One of the CMS systems I use will error out if an IP address is found in the query string for security reasons. Unfortunately, I need to get data sent from a payment gateway, and there's no way at the gateway to turn off the IP address that's being sent from them. If I'm to capture data sent to my CMS, then I need to have the IP in the query removed or replaced using HTACCESS.

    RewriteEngine On 
RewriteCond %{THE_REQUEST} ^GET\ /.*\ HTTP/ [NC]
RewriteCond %{QUERY_STRING} IP= [NC]
RewriteCond %{QUERY_STRING} (.*)(IP=[0-9]{1,3}%252E[0-9]{1,3}%252E[0-9]{1,3}%252E[0-9]{1,3})(.*) [NC]
RewriteRule .* %{REQUEST_URI}?%1%3 [R=301,L]

So, I started writing something like this, but honestly I suck at mod_rewrite, and regular expressions.

I don't care if it's set to IP=123, or just removed, but it can't be formatted as an IP. Please let me know if you can help!

Answer 1

I'm not sure about your first two RewriteConds but something like this should work...

RewriteCond %{QUERY_STRING} (.*)IP=\d{1,3}%2E\d{1,3}%2E\d{1,3}%2E\d{1,3}&(.*) [NC]
RewriteRule ^(.*)$ /$1?%1%2 [R=302,L]

This does assume that there will always be a parameter after the IP address, if that isn't the case you could remove the & but you would then end up with double ampersands. You could always move it to before IP if there is always a value preceeding it. Either way I'm assuming whatever service you are using is fairly standard.

NB: I always use 302 for testing purposes as once a browser caches a forward it can be difficult to test changes. Once it works change it back to 301.