How to execute a PHP web page without the .php extension in the URL?

Question

Sorry for noob question, can't understand from what I should search.

I'm making a site with that page product.php?id=777
I'd like it to be product/777

Thank you!

arma · Accepted Answer · 2011-04-08T10:10:06.073

22

Create .htaccess file in your web root and enter following there:

Options +FollowSymLinks
RewriteEngine on

RewriteRule ^product/([0-9]+)$ product.php?id=$1

edited Apr 08 '11 at 10:10

answered Apr 08 '11 at 00:23

arma

4,084
10
48
63

What strategy to use for product.php?id=777&storage=usa – Tuco Apr 08 '11 at 00:42
1

would this only go upto 9 as its not got the quantifier? ^product/([0-9]+)$ product.php?id=$1 – Lawrence Cherone Apr 08 '11 at 00:47
1

RewriteRule ^product/([0-9]+)/storage/(.*)$ product.php?id=$1&storage=$2 – Lawrence Cherone Apr 08 '11 at 00:49
Thanks for notifying me on quantifier tho this works without it, updated answer. – arma Apr 08 '11 at 10:09
This won't work for you if "AllowOverride" is set to "None" in the conf file. If you have access to httdp.conf the same commands can go into the right section. – Andrew Richard Miller Jul 01 '16 at 13:50

score 15 · Answer 2 · answered Apr 08 '11 at 00:23

15

Instead of using mod_rewrite you can also use following in your .htaccess:

 DefaultType application/x-httpd-php

And just name your script product on the server (without .php file extension).

So you can invoke it directly and would receive any appended string as $_SERVER["PATH_INFO"]

answered Apr 08 '11 at 00:23

mario

144,265
20
237
291

1

There are some significant security implications in doing this though, especially if the application allows user uploads. If a malicious user can upload a file and name it with an extension that Apache is not explicitly instructed to treat as something other than PHP, he will be able to execute PHP code on the server. – Apr 08 '11 at 03:12
1

Indeed. I'd hope the security ramifications are obvious. But just in case: The setting needs to be reset in subdirectories where unneeded. Particularily in world-writeable areas. (Which OTOH should not be below the webroot anyway.) – mario Apr 08 '11 at 03:16

score 7 · Answer 3 · edited May 28 '20 at 14:39

If you don't want to use mod_rewrite (I didn't) and the other answers didn't seem to work for you (they didn't for me). Then you might try this is you're running on Apache 2.4+.

The more insecure version: make anything without an extension run as a PHP file (this isn't so bad if, like my implementation you only have a single file for the whole server, but would still leave you open to arbitrary execution if someone were able to write a file into that directory... then again, if they can write a file, they could give it a PHP extension, so not really sure if this truly broadens your exposure.)

<FilesMatch "^[^.]+$">
    ForceType application/x-httpd-php
</FilesMatch>

Put this in either an .htaccess file for your directory (assuming you have those enabled) or put it directly in the piece in your host definition.

If you want to make it more specific (and maybe more secure) you can just replace the regex with something more concrete:

<FilesMatch "^MySingleFileWithNoExension$">
    ForceType application/x-httpd-php
</FilesMatch>

Edit: You do not need regex if you want to target only one file. Use this instead

<Files "MySingleFileWithNoExension">
    ForceType application/x-httpd-php
</Files>

Then just restart Apache and you're good to go!

score 2 · Answer 4 · answered Jun 03 '17 at 03:21

I did this for years using the following to execute a file named "Support" (NOT Support.php, I did NOT want two ways to gain access to the file).

<Files Support>
    SetHandler php-script
</Files>

However, I've started running into trouble with this when using Plesk to execute scripts as PHP 7.0. The root (.com/index.php) would run as PHP 7 just fine but any of my php-script files (.com/Support) would run as my version of Plesk's default PHP 5.4. I've yet to figure out why it's doing that, but it does get around the problem of setting a default handler.

I tried this in Apache 2.4.18: `` directive works, `SetHandler` doesn't. — Roger Dueck, Nov 07 '19 at 16:16

score 2 · Answer 5 · answered Apr 08 '11 at 00:23

2

This is something that frameworks like CodeIgniter and Zend accomplish with ease, but can still be accomplished with just Apache's mod_rewrite, as others have suggested. Basically, use a .htaccess like this to direct all traffic to a one page:

<IfModule mod_rewrite.c>
    RewriteEngine On

        RewriteCond                     %{REQUEST_FILENAME} !-f
        RewriteCond                     %{REQUEST_FILENAME} !-d
    RewriteRule                 ^(.*)$ index.php?_url=$1 [QSA,L]
</IfModule>

Once you get on that page you can parse that _url variable, which can be whatever format you want, and handle the request appropriately.

answered Apr 08 '11 at 00:23

Jimmy Sawczuk

13,488
7
46
60

Wouldn't CodeIgniter/Zend/Symfony/etc. all need to leverage mod_rewrite to accomplish what the OP is looking for anyway? – Apr 08 '11 at 14:15
1

Yes, what I meant was if you're JUST using `mod_rewrite` you have to bolt on all that routing yourself, but the frameworks have all that routing by default so all you have to do is enable `mod_rewrite`. – Jimmy Sawczuk Apr 08 '11 at 14:27

score 1 · Answer 6 · edited Apr 08 '16 at 16:40

For me this code work:

in "/etc/apache2/sites-available/default" or "httpd.conf"

you must have (at least) these options in the default directory

...
    <Directory />
        ...
        Options FollowSymLinks
        AllowOverride All
        ...
    </Directory>
...

OR in the site specific site directory

...
    <Directory "/var/www/my-site">
        ...
        Options FollowSymLinks
        AllowOverride All
        ...
    </Directory>
...

and create (it may not exist, make sure it is readable by apache) or edit the ".htaccess" in the directory of the site (for example "/var/www/my-site/.htaccess") and add this code:

AddType application/x-httpd-php htm html php
AddHandler application/x-httpd-php .htm .html

RewriteEngine On 
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^([^\.]+)$ $1.php [NC,L]

This catchall would fail if the uri is /hello.world – Jacques Jan 07 '18 at 06:03 — Jacques, Jan 07 '18 at 06:03

How to execute a PHP web page without the .php extension in the URL?

6 Answers6

Linked