可接受的mod_rewrite友好网址方法？

Question

I try to rewrite all url's to a single php file, unless the url leads to an existing file because existing files like images should be handled by the server directly. But if someone uses a url that looks like a file, and this file doesn't exist, it should get a 404.

I came up with the following .htaccess file. Is this a valid approach? It will be on a production server this friday so I would like to know for sure that there is no security risk or is a bad practice of some kind.

The first rule should make sure that any url that looks like if a file is being requested will get 404 (only if the file doesn't exist of course).

RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^(.*)\.([-A-z0-9]+)$ - [R=404,L]

If above doesn't match, there is a second rule that rewrites all other non existing files to index.php (like eg /products/23). In this case index.php will handle the rest of the routes.

RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^(.+)$ index.php [L]

If no rule mathes, it means it is an existing file is found and will be served by apache directly, like existing images and scripts.

Is this a valid approach? Thanks.

EDIT:

a slightly shorter approach with similar result:

RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^(.*)\.([-A-z0-9]+)$ - [R=404,L]

FallbackResource /index.php

Seems to work.

Answer 1

I would only do your second check (if file exists) and if not, always redirect to your index.php.

There you can do your checks for product etc. and use

header('HTTP/1.0 404 Not Found');
include('404.html');                  // <----- this is your 404 file
exit();

if you want to generate a 404 error.

Answer 2

Here is how I do it in my .htaccess file

RewriteEngine on
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php/$1