在Apache中使用htaccess来阻止查询stringinput

我一直盯着这一会儿，不是我无法理解它，可能是树木的场景。

我正在尝试使用HTACCESS来阻止对Web服务器的某些input，所以我添加了以下指令：

####################################### ## QUERY STRING / HTTP METHOD BLOCKS ## ####################################### # request query string contains /proc/self/environ RewriteCond %{QUERY_STRING} proc\/self\/environ [NC,OR] #request query string contains base64_encode / base64_decode RewriteCond %{QUERY_STRING} base64_(en|de)code[^(]*\([^)]*\) [NC,OR] # Block <script> in query string RewriteCond %{QUERY_STRING} (<|%3C)([^s]*s)+cript.*(>|%3E) [NC,OR] # Block out any script trying to modify a _REQUEST variable via URL RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2}) [NC,OR] # Prevent use of specified methods in HTTP Request RewriteCond %{REQUEST_METHOD} ^(HEAD|TRACE|DELETE|TRACK) [NC,OR] # Block out use of illegal or unsafe characters in the HTTP Request RewriteCond %{THE_REQUEST} ^.*(\\r|\\n|%0A|%0D).* [NC,OR] # Block out use of illegal or unsafe characters in the Referer Variable of the HTTP Request RewriteCond %{HTTP_REFERER} ^(.*)(<|>|'|%0A|%0D|%27|%3C|%3E|%00).* [NC,OR] # Block out use of illegal or unsafe characters in any cookie associated with the HTTP Request RewriteCond %{HTTP_COOKIE} ^.*(<|>|'|%0A|%0D|%27|%3C|%3E|%00).* [NC,OR] # Block out use of illegal characters in URI or use of malformed URI RewriteCond %{REQUEST_URI} ^/(,|;|:|<|>|">|"<|/|\\\.\.\\).{0,9999}.* [NC,OR] # Block out use of illegal or unsafe characters in the User Agent variable RewriteCond %{HTTP_USER_AGENT} ^.*(<|>|'|%0A|%0D|%27|%3C|%3E|%00).* [NC,OR] # Measures to block out SQL injection attacks RewriteCond %{QUERY_STRING} ^.*(;|<|>|'|"|\)|%0A|%0D|%22|%27|%3C|%3E|%00).*(/\*|union|select|insert|cast|set|declare|drop|update|md5|benchmark).* [NC,OR] # Block out reference to localhost/loopback/127.0.0.1 in the Query String RewriteCond %{QUERY_STRING} ^.*(localhost|loopback|127\.0\.0\.1).* [NC,OR] # Block out use of illegal or unsafe characters in the Query String variable RewriteCond %{QUERY_STRING} ^.*(<|>|'|%0A|%0D|%27|%3C|%3E|%00).* [NC] RewriteRule ^(.*)$ - [F] 

添加后，我期待如果我打开以下url：

• http://www.mysite.com/page.php?var=localhost
• http://www.mysite.com/page.php?var=drop

我会得到一个403错误，但是我看到的是page.php。 结论是指令是畸形的，没有被遵循。

• Nginx的404错误页面的PHP与PARAMS
• 在Litespeed上启用FastCGI
• 使用htaccess将单独的域名添加到WordPress的pipe理区域
• 如果文件存在于另一个文件夹如何重写使用htaccess？
• Apache2的mod_rewrite失败的不存在的子目录

有谁可以提供任何指导我可能出错的地方？