htaccess internal errors with using (escaped or unescaped) dots

Question

Maybe I'm doing something stupid, but I can't get rid of an issue with htaccess.

I'm trying to match a function name in a documentation site and I'm getting errors I can't understand. I must point that I (think I) know about regular expressions escaping, and I know what dot and backslash-dot mean.

So: i want to allow all of these:

example.com/foofunction
example.com/foofunction.php
example.com/function.foofunction
example.com/function.foofunction.php

These are the lines that I've tried. Those which cause error are misunderstood, so lots of thanks to anyone that can explain any to me:

^function\.([A-Za-z0-9_-]+)(\.php)?$ -> works, but makes function. mandatory

^(function\.)?([A-Za-z0-9_-]+)(\.php)?$ -> internal error... ok, let's not escape dot, in the end, it will match any character and will work...

^(function.)?([A-Za-z0-9_-]+)(\.php)?$ -> internal error too! ok, just for trying, dot outside conditional?

^(function)?\.([A-Za-z0-9_-]+)(\.php)?$ -> works, ok, but it makes dot mandatory. By the way, more crazy things:

^(function)?.([A-Za-z0-9_-]+)(\.php)?$ -> if dot isn't escaped (imagine I want to allow any character), internal error too. Now i`ll try to make dot optional separately

^(function)?(\.)?([A-Za-z0-9_-]+)(\.php)?$-> internal error too, i'm going crazy...

These are my tries up to now, I'm going to try optional lookbehind and update with results... anyway, i'd love to understand whi those regexes cause internal error.

And if anyone knows about an "htaccess special regex exceptions" reference or something like that i must read, wil be very wellcome.

Thanks in advance to all of you guys.

Answer 1

Use non capturing groups for everything apart from the actual function name:

^(?:function\.)?([A-Za-z0-9_\-]+)(?:\.php)?$

Let's break that down:

^                   # assert start of string
  (?:function\.)?   # optionally allow the string "function."
  ([A-Za-z0-9_\-]+) # capture the function name - this could be shortened to ([-\w]+)
  (?:\.php)?        # optionally allow the string ".php"
$                   # assert end of string

So your .htaccess would look (I guess) something like this:

RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(?:function\.)?([A-Za-z0-9_\-]+)(?:\.php)?$ doc.php?functionname=$1 [L,QSA]

---

IMPORTANT POINT and the actual solution in this case:

You must use a sensible combination of RewriteCond and (usually) the [L] flag to ensure that the rule matches only once.

mod_rewrite behaves in a slightly counter-intuitive way that is not always immediately apparent: it keeps running the rules over and over until there are no more matches. So, let's say I use the rule outlined above:

RewriteRule ^(?:function\.)?([A-Za-z0-9_\-]+)(?:\.php)?$ doc.php?functionname=$1

...and I supply to this rule the input function.myfunc.php. First, it will be rewritten to:

doc.php?functionname=myfunc

However, next time it will match again. And it will be rewritten to:

doc.php?functionname=doc

...and this will keep happening over and over until MaxRedirects is reached and Apache will throw an error - which you will see on the client side as a 500 response.

The solution to this depends on your exact use case, but a common solution (the one I used above) is to check whether the requested file exists before applying the rewrite rule. By doing this, on the second iteration the rule will not be applied, and the request will be allowed to fall through for further processing.

The [L] flag is also commonly (over)used - this causes the current iteration of the rewrite process to stop, and start again at the next iteration. It effectively does the same thing as continue does to a loop in PHP.

Since Apache 2.3, a much more useful flag (to this situation) is available - [END]. This gives the behaviour most people expect from [L], it causes the rewrite process to halt immediately with no further iterations, like the break construct in PHP. Using this would mean that the aforementioned RewriteConds are no longer necessary. However, because this is only available in 2.3+, it can't be safely used unless you know for certain it will be available in every environment you run on.