2

I have XAMPP installed on my Windows development machine and I always use Linux production machines. The most common mistake I make is to use a backslash for filespec. Either slash works on Windows, but the backslash fails on Linux.

Is there a way to stop the backslash from working on XAMPP on my Windows machine ?

3
  • Which directives in particular do you have an issue with?
    – MrWhite
    Apr 7 at 11:55
  • I was enquiring if there was an option in any of the apache ini files to stop backslash from working. Apr 7 at 12:00
  • "use a backslash for filespec" - Are you referring to URLs or Apache directives? (If URLs, which browser(s) are you testing?)
    – MrWhite
    Apr 7 at 17:46

1 Answer 1

2

Backslashes in file-paths in Apache directives

As far as I know, there is no option in Apache to prevent Apache/Windows from interpreting the backslash as a directory separator.

However, it is recommended to not use the backslash as a directory separator (on Windows) as you can get conflicts with backslash-escapes on certain directives. From the Apache docs:

  • The directives that accept filenames as arguments must use Windows filenames instead of Unix ones. However, because Apache may interpret backslashes as an "escape character" sequence, you should consistently use forward slashes in path names, not backslashes.

Any directive that takes an absolute file-path is unlikely to work unaltered on Linux anyway.

You just have to remember to always use forward slashes I'm afraid.


UPDATE: Backslashes in the URL-path

If, however, you are talking about the use of unencoded backslashes in the URL-path then you can do something, however...

  • AFAIK, there is no configurable option in Apache itself to disable unencoded backslashes in the URL-path.

  • You can block encoded backslashes (ie. %5C) in the URL-path by setting the following in the server config (not .htaccess):

    AllowEncodedSlashes Off
    

    This will result in such URLs returning a "404 Not Found". However, Off is the default, so unless this has been explicitly enabled already in the server config, then you do not need to do this.

  • Later versions of Chrome, Firefox and Safari (and reportedly Edge and IE) automatically convert any unencoded backslashes in the URL-path to (forward) slashes before making the request to your server. So your server never actually sees the backslash. Consequently, this means that these backslashed-URLs (that the user might request) will work just the same on Windows and Linux in these browsers (because there is no backslash reaching the server).

    Further reading (although a little dated):
    https://stackoverflow.com/questions/10438008/different-behaviours-of-treating-backslash-in-the-url-by-firefox-and-chrome

  • Strictly speaking a literal backslash character is not valid in the URL-path portion of the URL and should be URL-encoded (%-encoded) as %5C. Other browsers "should"*1 URL encode the backslash in the request, so these requests should be blocked by default anyway in these other browsers (by the default AllowEncodedSlashes state as mentioned above).

    (*1 I say "should" since modern browsers tend to auto-encode the requested URL as required when making the request, although strictly speaking this is something the user/developer should be doing explicitly.)

Blocking unencoded backslashes in the URL-path

If the unencoded backslash is actually reaching your server then you can use the following mod_rewrite rule at the top of the .htaccess file (or server config) to block requests that contain a backslash in the URL-path portion of the requested URL.

RewriteEngine On

# Send a "400 Bad Request" if backslash in requested URL-path
RewriteCond %{THE_REQUEST} "\s[^?]*\\"
RewriteRule ^ - [R=400]

Note that we need to check against THE_REQUEST in the condition above. The URL-path matched by the RewriteRule pattern (and the REQUEST_URI server variable) are pre-processed and have already had backslashes converted to (forward) slashes! So the backslash cannot be matched using these other methods.

(Tested using CURL against a Windows and Linux server.)

7
  • You couldn't write a RewriteRule to give an error for a backslash in a URL? Apr 7 at 12:21
  • @StephenOstermiller I'm not sure what you mean? Yes, you could check for a backslash in the URL, but I believe the OP is wondering how to prevent the use of the backslash as a directory separator in the Apache config directives, eg. DocumentRoot C:\xampp\vhosts\example.com\public_html.
    – MrWhite
    Apr 7 at 12:26
  • 1
    The way I interpret their problem is that Apache on Windows accepts backslashes in the URLs. They are using this as their development environment. Then when they go to release to production, they find that URLs that worked in dev don't work in production. If there were a mechanism to have Apache on Windows return an error for such URLs, they would be able to catch the problem early (as soon as they create a link with a backslash, not once they release to production). Apr 7 at 12:29
  • @StephenOstermiller Hhmm, could be. I wonder what browser(s) the OP is using to test? Chrome, Firefox and Safari appear to automatically convert any backslashes in the URL-path to (forward) slashes before making the request, so "backslashed" URLs will "work" in these browsers on both Windows and Linux. (I had to use CURL to test the above.) I've updated my answer.
    – MrWhite
    Apr 8 at 14:40
  • Firefox didn't backslashes to forward slashes at one point, but this was asked about 10 years ago: Different behaviours of treating \ (backslash) in the url by FireFox and Chrome -- and I see you already included this link, so you know that. but I hadn't realized that Firefox had changed at some point. Apr 8 at 15:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.