How to stop backslash working on XAMPP

Question

I have XAMPP installed on my Windows development machine and I always use Linux production machines. The most common mistake I make is to use a backslash for filespec. Either slash works on Windows, but the backslash fails on Linux.

Is there a way to stop the backslash from working on XAMPP on my Windows machine ?

Answer 1

Backslashes in file-paths in Apache directives

As far as I know, there is no option in Apache to prevent Apache/Windows from interpreting the backslash as a directory separator.

However, it is recommended to not use the backslash as a directory separator (on Windows) as you can get conflicts with backslash-escapes on certain directives. From the Apache docs:

• The directives that accept filenames as arguments must use Windows filenames instead of Unix ones. However, because Apache may interpret backslashes as an "escape character" sequence, you should consistently use forward slashes in path names, not backslashes.

Any directive that takes an absolute file-path is unlikely to work unaltered on Linux anyway.

You just have to remember to always use forward slashes I'm afraid.

---

UPDATE: Backslashes in the URL-path

If, however, you are talking about the use of unencoded backslashes in the URL-path then you can do something, however...

• AFAIK, there is no configurable option in Apache itself to disable unencoded backslashes in the URL-path.

• You can block encoded backslashes (ie. %5C) in the URL-path by setting the following in the server config (not .htaccess):

  AllowEncodedSlashes Off
  

  This will result in such URLs returning a "404 Not Found". However, Off is the default, so unless this has been explicitly enabled already in the server config, then you do not need to do this.

• Later versions of Chrome, Firefox and Safari (and reportedly Edge and IE) automatically convert any unencoded backslashes in the URL-path to (forward) slashes before making the request to your server. So your server never actually sees the backslash. Consequently, this means that these backslashed-URLs (that the user might request) will work just the same on Windows and Linux in these browsers (because there is no backslash reaching the server).

  Further reading (although a little dated):
  https://stackoverflow.com/questions/10438008/different-behaviours-of-treating-backslash-in-the-url-by-firefox-and-chrome

• Strictly speaking a literal backslash character is not valid in the URL-path portion of the URL and should be URL-encoded (%-encoded) as %5C. Other browsers "should"^*1 URL encode the backslash in the request, so these requests should be blocked by default anyway in these other browsers (by the default AllowEncodedSlashes state as mentioned above).

  ^{(*1 I say "should" since modern browsers tend to auto-encode the requested URL as required when making the request, although strictly speaking this is something the user/developer should be doing explicitly.)}

Blocking unencoded backslashes in the URL-path

If the unencoded backslash is actually reaching your server then you can use the following mod_rewrite rule at the top of the .htaccess file (or server config) to block requests that contain a backslash in the URL-path portion of the requested URL.

RewriteEngine On

# Send a "400 Bad Request" if backslash in requested URL-path
RewriteCond %{THE_REQUEST} "\s[^?]*\\"
RewriteRule ^ - [R=400]

Note that we need to check against THE_REQUEST in the condition above. The URL-path matched by the RewriteRule pattern (and the REQUEST_URI server variable) are pre-processed and have already had backslashes converted to (forward) slashes! So the backslash cannot be matched using these other methods.

^{(Tested using CURL against a Windows and Linux server.)}