Apache Rewrite Rules: A Guide to Question Marks and Query Strings

When working with Apache’s mod_rewrite module, you’ll often encounter the need to handle query strings. This article explains how the question mark (?) and the QSA flag are used in Apache Rewrite Rules to manage and manipulate URLs without exposing sensitive information.

What are Rewrite Rules?

Apache Rewrite Rules are powerful directives used to rewrite URLs on the fly. They’re composed of two main parts:

• RewriteCond: This directive sets a condition for the subsequent RewriteRule. Think of it as an “if” statement. The RewriteRule is only executed if the RewriteCond evaluates to true.
• RewriteRule: This is the core directive that performs the actual URL rewriting. It takes a regular expression to match a URL pattern and a substitution string to define the new URL.

For example, a common use case is redirecting broken image links to a placeholder image.

Apache

RewriteCond %{REQUEST_FILENAME} !-F
RewriteRule ^(.*)\.(jpg|png|gif|ico)$ https://example.com/img/404.png [L,R=301]

In this example, the RewriteCond checks if the requested file (%{REQUEST_FILENAME}) does not exist (!-F). If that condition is met, the RewriteRule then rewrites any request for a .jpg, .png, .gif, or .ico file to a 404.png image and issues a permanent redirect (R=301). The [L] flag means this is the last rule to be processed.

Handling Query Strings

Query strings are the part of a URL that follows a question mark (?), containing key-value pairs separated by ampersands (&), for example: ?id=42&page=2.

The Importance of the [QSA] Flag

By default, when Apache rewrites a URL, the original query string is dropped. This is often undesirable, as you might need to preserve the parameters for the backend application.

This is where the [QSA] (Query String Append) flag comes in. [QSA] explicitly tells Apache to append the original query string to the new, rewritten URL.

Let’s look at a practical example. Imagine you have a clean URL structure for your API: api/users but your backend script requires a query string: api.php?service=users.

Apache

RewriteRule ^api/([_a-zA-Z0-9]{3,30})$ api.php?service=$1 [QSA,L]

In this RewriteRule, ^api/([_a-zA-Z0-9]{3,30})$ matches URLs like api/users and captures users in $1. The URL is rewritten to api.php?service=$1.

Now, if a user accesses the following URL with a query string:

https://example.com/api/users?id=42

Without the [QSA] flag, the URL would be rewritten to:

https://example.com/api.php?service=users

However, with the [QSA] flag, the original query string ?id=42 is appended, resulting in:

https://example.com/api.php?service=users&id=42

This ensures that all original query parameters are preserved and passed to your backend script, maintaining full functionality.

The Question Mark in Rewrite Rules

The question mark also plays a special role within the regular expression part of a RewriteRule. In regex, the ? character is a quantifier that means “zero or one” of the preceding element.

For example, colou?r would match both color and colour.

To match a literal question mark in the URL, you need to escape it with a backslash: \?. For instance, to match a URL like page.php?id=1, your regex might start with ^page\.php\?.

However, mod_rewrite automatically handles the query string separately. The regex in RewriteRule only matches the part of the URL before the first question mark. This means you generally don’t need to explicitly match the ? itself in your RewriteRule regex. This behavior is key to understanding how rewrite rules process URLs.

I hope this updated guide helps you master Apache’s powerful mod_rewrite module.

Happy coding and remember…
Try it at home!