: Which component handle php's GET parameters in a URL In a webserver, which component handles the translation of URL parameters to the $_GET global variable? Is that a module in PHP engine, or

@Ogunnowo487

The $_GET PHP superglobal is set by PHP when it parses the URL's query string (request headers) made available through Apache. As far as I know you can not prevent PHP from doing this.

However, you can reset this variable at the top of your script. eg. $_GET = Array();

And neither can you prevent Apache from parsing the URL / query string. This is intrinsic to any webserver. Apache only parses out the query string as a whole, it does not separate it into URL parameters - that is what the server-side language parser does (PHP in this case).

The best you can do is either block requests that contain a query string or redirect to the canonical URL (since the user can always append a query string to the request).

For example, to block requests (ie. send a 403 Forbidden) that contain a query string, in your server config using mod_rewrite on Apache:

RewriteEngine On
RewriteCond %{QUERY_STRING} .
RewriteRule ^ - [F]


Or, to redirect to the same URL, less the query string

RewriteEngine On
RewriteCond %{QUERY_STRING} .
RewriteRule ^ %{REQUEST_URI}? [R=301,L]


On Apache 2.4 you can use the QSD param to Discard the Query String instead of appending a ? to the end of the RewriteRule substitution. ie. RewriteRule ^ %{REQUEST_URI} [QSD,R=301,L].

By removing the query string from the request then the PHP $_GET superglobal will naturally be empty.

Vote Up Vote Down

@Cofer257

GET/POST are HTTP headers that either request/send data. These are handled by the server initially and are part of the standard HTTP request methods.

To do this in Apache, at the top of your domain config:

<Limit GET>
deny from all
</Limit>


You can test which methods are available by sending an OPTIONS request to the server. This should return all the possible methods accepted on the server end.

Edit: New answer since the question has been changed.

The PHP module in Apache can be disabled but then you can't parse PHP files. What you're looking to do is prevent the use of Query strings. The answer here is to rewrite them before they're passed on when the PHP file is parsed and run. You'll want to configure Apache to drop query strings with a rewrite:

RewriteEngine On
RewriteCond %{QUERY_STRING} *.
RewriteRule (.*) ? [R=permanent]

Vote Up Vote Down