I have a website that uses a set of quite simple RewriteRules of the format:
RewriteRule ^p/(.*)$ /product.php?$1 [L]
All was working well and still is working perfectly fine on localhost. For some reason, without me making any changes, those pages have started returning a 403 Forbidden error.
The problem seems to be spaces (encoded as %20) in the url query string. Looking in the logs shows this error
[rewrite:error] [pid xxxx:tid xxxxxxxxxxxxxx] [client xxx.xxx.xxx.xx:xxxxx] AH10411: Rewritten query string contains control characters or spaces
example.com/p/parameter%20name=value gives a 403 whereas
Just adding spaces to a query string on a page that has a rewrite rule that doesn't use the query string doesn't cause an error.
e.g. the rule
RewriteRule ^contact-us/$ /contact.php [L] doesn't have a problem with the url
I'm aware that using + instead of %20 is a possibility or not using spaces at all. Both are not very practical options at the moment and using %20 was perfectly fine until about a day ago.
I can't see any permissions issues anywhere either.
Has anyone else come across this issue?
As Mr White points out in his answer, the trick here is to make sure the
B flag is set on the Rewrite rules in htaccess.
Because I am accessing the full query string using
$_SERVER['QUERY_STRING'] I then needed to use
urldecode as well.
This then returns the same output that I used to get before the Apache update.