htacess url rewrite? on a php get system

Question

I use the code below to basically go to my pages. How it works is I put index.php?req=pagename and it will check my protected folder to see if the file is there if it is then it goes there. I need a mod rewrite so that it doesnt show all that index.php?req=pagename and just shows /pagename

    require_once("protected/header.php");

    if (isset($_GET['req'])) {
        $req = $_GET['req'];
    } else {
        $req = "overall";
    }

    require_once("protected/$req.php");
    require_once("protected/footer.php");

Answer 1

Your code allows any php file (barring safemode/open_basedir restrictions) to be parsed and executed. You need to escape that input first , even if it's something as rudimentary as removing slashes, tildes and periods.

As far as rewrite goes, simply create a .htaccess file in your document root along the lines of:

<IfModule mod_rewrite.c>
RewriteEngine On
#RewriteBase /
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^(.*)$ /index.php?req=$1 [QSA,L]
</IfModule>

Answer 2

You will have to use POST instead of GET if you want a clean dynamic url. Your question though doesn't make much sense.