How can I redirect %26 in URLs to %2526 using a .htaccess rule?

Question

I would like .htaccess to redirect:

example.com/something_%26_else

to

example.com/something_%2526_else

I'm importing a bunch of pages that have ampersands in the title from MediaWiki. These are encoded as %26. Drupal, for various reasons, has decided double encode the URL to have it become %2526. I simply can't create the alias within Drupal so I have to use .htaccess.

This is what I have as my rule so far:

RewriteRule ^w/([^%26]+)\%26(.*)$ w/$1\%2526$2 [R=301]

I asked this question three months ago on StackOverflow and was not able to get it working. I tried hiring a contractor for this but was unable to find one. So this is my last ditch effort before I completely give up. I really appreciate the help.

Answer 1

'noescape|NE' (no URI escaping of output)

This flag prevents mod_rewrite from applying the usual URI escaping rules to the result of a rewrite. Ordinarily, special characters (such as '%', '$', ';', and so on) will be escaped into their hexcode equivalents ('%25', '%24', and '%3B', respectively); this flag prevents this from happening. This allows percent symbols to appear in the output

mod_rewrite Documentation at Apache.org

Answer 2

Have a look at my answer (on Drupal.SE) to the question "How to use the Rules module to implement a custom redirect for an outdated URL?". I bet the solution described there (using the Rules module) also works for this case.

As detailed in that answer: the "clue" to get this to work, is to use the Rules Event "Drupal is initializing". That will ensure that the rule gets triggered BEFORE the actual content is shown.

Answer 3

I had similar problem where the the '&' was incorrectly rewritten by the mod_rewrite. The B flag solved it:

B (escape backreferences) The [B] flag instructs RewriteRule to escape non-alphanumeric characters before applying the transformation.

It allowed me to serve the files containing '&' within their name, eg here

Answer 4

To clarify, %26 is a URL-encoded (aka "%-encoded") & (ampersand).

To redirect a request for /something%26else literally (or /something&else, since the ampersand does not need to be escaped in the URL-path) to /something%2526else (ie. /something%26else when decoded) then you could do something like:

RewriteRule ^(something)&(else)$ /$1\%26$2 [R,L]

Or, the more generic /<anything>%26<anything>:

RewriteRule (.*)&(.*) /$1\%26$2 [R,L]

The RewriteRule pattern matches against the %-decoded URL-path (ie. &, not %26). So you should simply specify & (ampersand) literally. Note that this will match a request for both /something_%26_else and /something_&_else.

The % (percent) in the RewriteRule substitution needs to be backslash escaped in order to represent a literal %, otherwise it's going to be seen as a backreference to the last matched CondPattern, and there isn't any, so %2 would otherwise becomes an empty string!

Without the NE (noescape) flag, mod_rewrite will automatically encode the substitution URL, which is actually what we want in this instance: %26 gets encoded as %2526. (Which, when decoded, is seen as a literal %26.)

---

Alternatively, you could use the NE flag (that @danlefree mentions) and then manually encode the substitution:

RewriteRule (.*)&(.*) /$1\%2526$2 [R,L,NE]

However, this will have issues if there are other %-encoded characters in the URL (unless you match a literal "something" and "else"), as they won't be encoded in the response.

---

Another alternative is to capture the encoded URL from THE_REQUEST server variable (which contains the URL as it appears on the initial request) and simply pass this through to the substitution which then doubly encodes the target URL (in the absence of the NE flag):

RewriteCond %{THE_REQUEST} \s(.*\%26.*)\s
RewriteRule & %1 [R,L]

The check for %26 in the condition is required in case an unencoded "&" is sent in the request (to prevent a redirect loop). The RewriteRule pattern & matches both & and %26 in the requested URL-path (because the URL-path that is matched by the RewriteRule pattern is first URL-decoded).

A caveat with this approach is that if there are any other %-encoded characters in the requested URL then they will also be doubly encoded.