How Do I Disable Unwanted Requests? (MySQL, .htaccess, PHP)

Question

To start, I am a beginner with PHP and .htaccess. Here is my dilemma...

I have built dynamic pages and used htaccess to rewrite the urls. There are 3 types of pages... Examples:

State: example.com/massachusetts-colleges.html

City: example.com/massachusetts-colleges/boston-ma-colleges.html

College: example.com/massachusetts-colleges/boston-ma-colleges/harvard.html

The problem is that pages are being requested (from old linking structure probably) that shouldn't exist such as:

example.com/boston-ma-colleges.html

The state urls are stored in a locations table in the database (stateSlug = massachusetts-colleges). The city urls are also stored in the locations table in the database and the corresponding state slug is also stored with that city (citySlug = boston-ma-colleges and stateSlug = massachusetts-colleges). The Colleges are stored in a different table and use ID's to correspond with the cities.

How can I use .htaccess to prevent any "OTHER" urls from being accessible (page displays template and no data), and show a 404 page (or redirect to home page)?

This is what my .htaccess file looks like now:

RewriteEngine on
RewriteRule ^([^/\.]+)\.html?$ php/statePage.php?stateSlug=$1 [L]
RewriteRule ^([^/\.]+)-colleges/([^/\.]+)\.html?$ php/cityPage.php?citySlug=$2&stateSlug=$1 [L]
RewriteRule ^([^/\.]+)-colleges/([^/\.]+)/([^/\.]+)\.html?$ php/collegePage.php?collegeSlug=$3&citySlug=$2&stateSlug=$1 [L]

Again, I am somewhat new to the htaccess and php languages. I would appreciate any help in this matter.

Thank you!

Answer 1

Assuming all of your content is matched by one of the above URLs, you can simply forbid access to everything else by adding another rule to the end:

RewriteRule ^(.*)$ - [F]

To avoid messing with requests your images and CSS, you should add:

RewriteCond %{REQUEST_FILENAME} !\.(jpg|png|gif|js|css)$ [NC]
RewriteRule ^(.*)$ - [F]

If you have directories which should be made inaccessible, place a .htaccess in them with only the following:

Order deny,allow
deny from all

Answer 2

rewrite all your public files to fake directory /allow/.. , display 404 for any request which is not in /allow/.. directory. Finally rewrite files from /allow/.. to real directory.

It's great workaround IMO :) Better than using deny all in every dir...

Answer 3

Try the following, but replace index.php with your 404 page:

Order allow,deny
Allow from all
RewriteEngine On

RewriteBase /
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php?/$l [L]

This should redirect all file and directory requests that were not found to index.php or your choice of script file, a 404 page for example. Just remember to set the headers to a 404 response code.

I got this from the CodeIgniter wiki page at http://codeigniter.com/wiki/mod_rewrite/

Their wiki page was very helpful when I tried to solve a similar problem.