Increase security in .htaccess

[Slackervaara]

I have been thinking about increasing security of .htaccess and stopping SQL-injection. Today I found this suggestion for htaccess:

RewriteCond %{QUERY_STRING} .*jos_.* [NC,OR]

http://www.webmaster-forums.net/web-pro ... ase-advise

Grateful for input!

[Slackervaara]

I have now added it to .htaccess after this statement:
# Block out any script trying to set a PHP GLOBALS variable via URL
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]

The site seems to work normally and I hope to get extra protection against sql-injection.

[PhilD]

So your experiments with the Suggested master htaccess file http://docs.joomla.org/Htaccess_example ... ccess_file
and specifically this within the file to help prevent sql injections did not work?

Code: Select all

## SQLi first line of defense, thanks to Radek Suski (SigSiu.net) @
## http://www.sigsiu.net/presentation/fortifying_your_joomla_website.html
## May cause problems on legitimate requests
RewriteCond %{QUERY_STRING} concat[^\(]*\( [NC,OR]
RewriteCond %{QUERY_STRING} union([^s]*s)+elect [NC,OR]
RewriteCond %{QUERY_STRING} union([^a]*a)+ll([^s]*s)+elect [NC]
RewriteRule .* - [F]

[Slackervaara]

It is recommended to change the jos_ prefix to something else and as I have not done that I want to add this jos_ entry in htaccess as extra protection.