How do you configure Apache/PHP to accept slashes in query strings?

Question

I have two Apache servers running PHP. One accepts forward-slashes in the query string and passes it along to PHP in the expected way, for example:

http://server/index.php?url=http://foo.bar

works and in PHP this expression is true:

$_REQUEST['url'] == "http://foo.bar"

However, in the other Apache server, the same URL results in a 403 Forbidden error! Note that if the query string is properly URL-escaped (i.e. with %2F instead of forward-slash), then everything works.

Clearly there's some difference in the Apache or PHP configuration that causes this, but I can't figure out what!

I want to accept this form of URL in both cases, not reject it.

Answer 1

This sounds like another case of default magic_quotes_gpc. On the server causing problems check the php.ini and make sure that

magic_quotes_gpc = Off

Answer 2

You dont specify what PHP does with this url. Does it redirect to this page or try to read it?

There is probably some mod_rewrite rule to remove double slashes, or for some other purpose, which tries to redirect this to somewhere it should not.

Maybe a regex without ^ before http://

Answer 3

http://server/index.php?url=http://foo.bar is not a valid url. You have to encode the slashes. I think browsers do this automagically, so maybe you were testing with different browsers?

Or perhaps it's the AllowEncodedSlashes setting?

Answer 4

Note that if the query string is properly URL-escaped (i.e. with %2F instead of forward-slash), then everything works.

So it works when the query string is properly formatted and doesn't work when it isn't. What's the problem?

Answer 5

In your Apache config:

AllowEncodedSlashes On

See the documentation for more information: http://httpd.apache.org/docs/2.2/mod/core.html#allowencodedslashes

Edit: Hmm, this may be what you already have working... I had this same problem, and what ended up fixing it for me was to just use $_SERVER['REQUEST_URI'] as that had the data I needed.

Answer 6

Do you have mod_security installed? See this thread:

http://stackoverflow.com/questions/1089744/403-forbidden-on-php-page-called-with-url-encoded-in-a-get-parameter