htaccess指南

htaccess指南
這是關於.htaccess的一篇介紹,也是很容易讓人理解的一篇關於.htaccess應用的文檔，我隨意翻譯了一下，自己也玩一玩.htaccess
轉載自:[url]http://weblog.qiran.org/2005/09/htaccess.html[/url]
• Part 1 – Introduction介紹
• Part 2 - .htaccess Commande命令
• Part 3 - Password protection密碼保護

Part 1 – Introduction介紹

Introduction 介紹


從本指南中，您可以學習到有關.htaccess文檔及其功能，用以優化您的網站。儘管.htaccess只是一個文檔，但它可以更改服務器的設置，允許您做許多不同的事情，最流行的功能是您可以創建自定義的“404 error”頁面。.htaccess 並不難於應用，只是在一個text文檔中添加幾條簡單的指令而已。

Will My Host Support It? 我的主機支持它嗎？

This is probably the hardest question to give a simple answer to. Many hosts support .htaccess but don't actually publicise it and many other hosts have the capability but do not allow their users to have a .htaccess file. As a general rule, if your server runs Unix or Linux, or any version of the Apache web server it will support .htaccess, although your host may not allow you to use it.
這可能很難用簡單的答案來回答。許多主機支持.htaccess但實際上並不會明確聲明，許多其他類型的主機有能力但並不允許他們的用戶使用. htaccess文檔。作爲一般性的規則，如果你的主機使用Unix或Linux系統，或任何版本的Apache網絡服務器，它一般來說是支持. htaccess的，儘管你的主機服務器可能不允許你使用它。

A good sign of whether your host allows .htaccess files is if they support password protection of folders. To do this they will need to offer .htaccess (although in a few cases they will offer password protection but not let you use .htaccess). The best thing to do if you are unsure is to either upload your own .htaccess file and see if it works or e-mail your web host and ask them.
你的主機是否允許.htaccess，很好的一個標誌是它是否支持文件夾的密碼保護。爲此，他們將提供.htaccess支持（儘管少數情況下他們提供密碼保護功能但不允許你使用.htaccess）。如果你不確定，最好的辦法一是上傳你自己的.htaccess文檔看看是否有用，二是e-mail給你的主機服務商詢問。

What Can I Do? 我該怎麼做？

You may be wondering what .htaccess can do, or you may have read about some of its uses but don't realise how many things you can actually do with it.
你可能疑惑.htaccess到底能做些什麼，或者你可能曾知道它的一些功能但並不真正瞭解你實際到底可以用它來做多少事情。

There is a huge range of things .htaccess can do including: password protecting folders, redirecting users automatically, custom error pages, changing your file extensions, banning users with certian IP addresses, only allowing users with certain IP addresses, stopping directory listings and using a different file as the index file.
.htaccess可以做大量範圍的事情，包括：文件夾密碼保護、用戶自動重新指向、自定義錯誤頁面、變更你的文件擴展名、屏蔽特定的用戶IP地址、只允許特定的IP地址、停止目錄表以及使用其他文件作爲index文件。

Creating A .htaccess File 創建一個.htaccess文檔

Creating a .htaccess file may cause you a few problems. Writing the file is easy, you just need enter the appropriate code into a text editor (like notepad). You may run into problems with saving the file. Because .htaccess is a strange file name (the file actually has no name but a 8 letter file extension) it may not be accepted on certain systems (e.g. Windows 3.1). With most operating systems, though, all you need to do is to save the file by entering the name as:
創建.htaccess文檔也許會給你帶來幾個問題。寫文檔很容易，你只需要在文字編緝器（例如：寫字板）裏寫下適當的代碼。然後，你可能會遇到保存文檔的困難，因爲.htaccess是一個古怪的文件名（文檔事實上沒有文件名，只有一個由8個字母組成的擴展名），一些系統（例如windows 3.1）無法接受這樣的文件名。在大多數的操作系統中，你需要做的是將文檔保存成名爲：

".htaccess"
(including the quotes). If this doesn't work, you will need to name it something else (e.g. htaccess.txt) and then upload it to the server. Once you have uploaded the file you can then rename it using an FTP program.
（包括引號）。如果這也不行，你需要將其命名爲其他的名字（例如htaccess.txt），再將其上傳到服務器上，此後你就可以利用FTP軟件來重命名它了。

Warning 警告

Before beginning using .htaccess, I should give you one warning. Although using .htaccess on your server is extremely unlikely to cause you any problems (if something is wrong it simply won't work), you should be wary if you are using the Microsoft FrontPage Extensions. The FrontPage extensions use the .htaccess file so you should not really edit it to add your own information. If you do want to (this is not recommended, but possible) you should download the .htaccess file from your server first (if it exists) and then add your code to the beginning.
在使用.htaccess之前，我必須給你一些警告。儘管在服務器上使用.htaccess絕對不太可能給你帶來任何麻煩（如果有些東西錯了，它只是沒效用罷了），但如果你使用Microsoft FrontPage Extensions你就需要小心些。FrontPage Extensions使用了.htaccess，因此你不能編輯它，加入你自己的信息。如果你需要（並不推薦，但是可能）你應該先從服務器上下載. htaccess文檔（如果存在），之後在前面加上你的代碼。

Custom Error Pages 自定義錯誤頁

The first use of the .htaccess file which I will cover is custom error pages. These will allow you to have your own, personal error pages (for example when a file is not found) instead of using your host's error pages or having no page. This will make your site seem much more professional in the unlikely event of an error. It will also allow you to create scripts to notify you if there is an error (for example I use a PHP script on Free Webmaster Help to automatically e-mail me when a page is not found).
我想介紹的.htaccess第一個應用是自定義錯誤頁面，這使得你可以擁有自己的、個性化的錯誤頁面（例如找不到文件時），而不是你的服務商提供的錯誤頁或沒有任何頁面。這會讓你的網站在出錯的時候看上去更加專業。你還可以利用腳本程序在發生錯誤的時候通知你（例如我使用Free Webmaster Help的PHP腳本程序，當找不到頁面的時候自動e-mail給我）。

You can use custom error pages for any error as long as you know its number (like 404 for page not found) by adding the following to your .htaccess file:
任何你知道代碼的錯誤（像404找不到頁面），你都可以將其變成自定義頁面，要做的只是在.htaccess文件里加入以下一段：

ErrorDocument errornumber /file.html
For example if I had the file notfound.html in the root direct
ory of my site and I wanted to use it for a 404 error I would use:
例如，如果我的根目錄下有一個nofound.html文檔，我想使用它作爲404 error的頁面：

ErrorDocument 404 /notfound.html
If the file is not in the root directory of your site, you just need to put the path to it:
如果文件不在網站的根目錄下，你只需要把路徑設置爲：

ErrorDocument 500 /errorpages/500.html
These are some of the most common errors:
以下是一些最常用的錯誤：

401 - Authorization Required
400 - Bad request
403 - Forbidden
500 - Internal Server Error
404 - Wrong page
Then, all you need to do is to create a file to display when the error happens and upload it and the .htaccess file.
這樣，你要做的只是生成一個錯誤顯示文檔，然後把它們上傳。


Part 2 - .htaccess 命令

Introduction 介紹

In the last part I introduced you to .htaccess and some of its useful features. In this part I will show you how to use the .htaccess file to implement some of these.
上一部分中我已經將你引入了.htaccess以及它的一些有用的功能，在這一部分裏，我將向您演示如何應用.htaccess文檔去實現這些功能。

Stop A Directory Index From Being Shown 停示顯示目錄索引

Sometimes, for one reason or another, you will have no index file in your directory. This will, of course, mean that if someone types the directory name into their browser, a full listing of all the files in that directory will be shown. This could be a security risk for your site.
有些時候，由於某種原因，你的目錄裏沒有index文件，當然這樣意味着如果有人在瀏覽器地址欄鍵入了該目錄的路徑，該目錄下所有的文件都會顯示出來，這造成了網站的安全威脅。

To prevent against this (without creating lots of new 'index' files, you can enter a command into your .htaccess file to stop the directory list from being shown:
爲了避免這種情況（而不必創建一堆的新index文檔），你可以在你的.htaccess文檔中鍵入以下命令，用以阻止目錄索引的顯示：

Options -Indexes
Deny/Allow Certian IP Addresses 阻止/允許特定的IP地址

In some situations, you may want to only allow people with specific IP addresses to access your site (for example, only allowing people using a particular ISP to get into a certian directory) or you may want to ban certian IP addresses (for example, keeping disruptive memembers out of your message boards). Of course, this will only work if you know the IP addresses you want to ban and, as most people on the internet now have a dynamic IP address, so this is not always the best way to limit usage.
有些情況下，你可能只想允許某些特定IP的用戶可以訪問你的網站（例如：只允許使用特定ISP的用戶進入某個目錄），或者你想攔截某些特定的IP地址（例如：將低級用戶隔離於你的信息面版外）。當然，這隻在你知道你想攔截的IP地址時纔有用，然而現在網上的大多數用戶都使用動態IP地址，所以這並不是限制使用的常用方法。

You can block an IP address by using:
你可以使用以下命令攔截一個IP地址：

deny from 000.000.000.000
where 000.000.000.000 is the IP address. If you only specify 1 or 2 of the groups of numbers, you will block a whole range.
被攔截的IP地址則爲000.000.000.000，如果你只指定其中1或2個代碼組，你可以攔截整個區域的地址。

You can allow an IP address by using:
你可以使用以下命令允許一個IP地址的訪問：

allow from 000.000.000.000
where 000.000.000.000 is the IP address. If you only specify 1 or 2 of the groups of numbers, you will allow a whole range.
被允許的IP地址則爲000.000.000.000，如果你只指定其中1或2個代碼組，你可以允許整個區域的地址。

[ 本帖最後由 redasurc 於 2006-2-9 15:06 編輯 ]
If you want to deny everyone from accessing a directory, you can use:
如果你想阻止所有人訪問該文件目錄，你可以使用：

deny from all
but this will still allow scripts to use the files in the directory.
但這將仍然允許腳本程序使用這個目錄下的文檔。

Alternative Index Files 替代的index文檔

You may not always want to use index.htm or index.html as your index file for a directory, for example if you are using PHP files in your site, you may want index.php to be the index file for a directory. You are not limited to 'index' files though. Using .htaccess you can set foofoo.blah to be your index file if you want to!
也許你不想一直使用index.htm或index.html來作爲目錄的索引文檔，例如你的站點使用PHP文檔，你會想使用 index.php來作爲該目錄的索引文檔。當然也不必侷限於“index”文檔，如果你願意，你儘管使用foofoo.balh來作爲你的索引文檔！

Alternate index files are entered in a list. The server will work from left to right, checking to see if each file exists, if none of them exisit it will display a directory listing (unless, of course, you have turned this off).
替代的索引文檔可以排成一個列表，服務器會從左至右進行尋找，看看哪個文檔在真實的目錄中存在。如果一個也找不到，它將會把目錄清單顯示出來（當然除非你關閉了顯示目錄文件清單）。

DirectoryIndex index.php index.php3 messagebrd.pl index.html index.htm
Redirection 重新指向

One of the most useful functions of the .htaccess file is to redirect requests to different files, either on the same server, or on a completely different web site. It can be extremely useful if you change the name of one of your files but allow users to still find it. Another use (which I find very useful) is to redirect to a longer URL, for example in my newsletters I can use a very short URL for my affiliate links. The following can be done to redirect a specific file:
.htaccess其中一個極其有用的功能，就是將請求重新指向站內或站外的不同文檔。當你改變了一個文檔名稱時但仍然想讓用戶仍然可以用舊鏈接找到它，這個時候此功能將變得極其有用。另一個應用（我發現的很有用的）是重新指向一個長URL，例如在我的時事信息中，我可以使用一個很簡短的URL來指向我的聯合鏈接。以下是一個重新指向特定文檔的例子：

Redirect /location/from/root/file.ext [url]http://www.othersite.com/new/file/location.xyz[/url]
In this above example, a file in the root directory called oldfile.html would be entered as:
上述的例子中，訪問在root目錄下的名爲oldfile.html可以鍵入：

/oldfile.html
and a file in the old subdirectory would be entered as:
訪問一箇舊次級目錄中的文件可以鍵入：

/old/oldfile.html
You can also redirect whole directoires of your site using the .htaccess file, for example if you had a directory called olddirectory on your site and you had set up the same files on a new site at: [url]http://www.newsite.com/newdirectory/[/url] you could redirect all the files in that directory without having to specify each one:
你也可以使用.htaccess將整個網站的目錄都做重新指向，假如你的網站上有一個名爲olddirectory的目錄，並且你已經在一個新網站 [url]http://www.newsite.com/newdirectory/[/url]上建立了與上相同的文檔，你可以將舊目錄下所有的文件做一次重新指向而不必一一聲明：

Redirect /olddirectory [url]http://www.newsite.com/newdirectory[/url]
Then, any request to your site below /olddirectory will bee redirected to the new site, with the
extra information in the URL added on, for example if someone typed in:
這樣，任何指向到站點中/olddirectory的請求都將被重新指向新的站點，包括附加的額外URL信息。例如有人鍵入：

http://www.youroldsite.com/olddirecotry/oldfiles/images/image.gif
They would be redirected to:
請求將被重新指向到：

http://www.newsite.com/newdirectory/oldfiles/images/image.gif
This can prove to be extremely powerful if used correctly.
如果正確使用，本功能將極其強大。

Part 3 – 密碼保護

Introduction 介紹

Although there are many uses of the .htaccess file, by far the most popular, and probably most useful, is being able to relaibly password protect directories on websites. Although JavaScript etc. can also be used to do this, only .htaccess has total security (as someone must know the password to get into the directory, there are no 'back doors')
儘管有各種各樣的.htaccess用法，但至今最流行的也可能是最有用的做法是將其用於網站目錄的可靠的密碼保護。儘管JavaScrip等也能做到，但只有.htaccess具有完美的安全（即訪問者必須知曉密碼纔可以訪問目錄，並且絕無“後門”可走）。

The .htaccess File

Adding password protection to a directory using .htaccess takes two stages. The first part is to add the appropriate lines to your .htaccess file in the directory you would like to protect. Everything below this directory will be password protected:
利用.htaccess將一個目錄加上密碼保護分兩個步驟。第一步是在你的.htaccess文檔里加上適當的幾行代碼，再將.htaccess文檔放進你要保護的目錄下：

AuthName "Section Name"
AuthType Basic
AuthUserFile /full/path/to/.htpasswd
Require valid-user
There are a few parts of this which you will need to change for your site. You should replace "Section Name" with the name of the part of the site you are protecting e.g. "Members Area".
有幾個小部分你可能需要根據你的網站情況而修改一下。用被保護部分的名字替換掉”Section Name”，例如"Members Area"。

The /full/parth/to/.htpasswd should be changed to reflect the full server path to the .htpasswd file (more on this later). If you do not know what the full path to your webspace is, contact your system administrator for details.
另外/full/parth/to/.htpasswd 應該替換爲指向.htpasswd文檔（後面詳述該文檔）的完整服務器路徑。如果你不知道你網站空間的完整路徑，詢問一下你的系統管理員。

The .htpasswd File

Password protecting a directory takes a little more work than any of the other .htaccess functions because you must also create a file to contain the usernames and passwords which are allowed to access the site. These should be placed in a file which (by default) should be called .htpasswd. Like the .htaccess file, this is a file with no name and an 8 letter extension. This can be placed anywhere within you website (as the passwords are encrypted) but it is advisable to store it outside the web root so that it is impossible to access it from the web.
目錄的密碼保護比.htaccess的其他功能要麻煩些，因爲你必須同時創建一個包含用戶名和密碼的文檔，用於訪問你的網站，相關信息（默認）應位於一個名爲.htpasswd的文檔裏，像.htaccess一樣，.htpasswd也是一個沒有文件名且具有8位擴展名的文檔，可以放置在你網站裏的任何地方（此時密碼應加密），但建議你將其保存在網站根目錄外，這樣通過網絡就無法訪問到它了。

Entering Usernames And Passwords 輸入用戶名和密碼

Once you have created your .htpasswd file (you can do this in a standard text editor) you must enter the usernames and passwords to access the site. They should be entered as follows:
創建好.htpasswd文檔後（可以通過文字編輯器創建），下一步是輸入用於訪問網站的用戶名和密碼，應爲：

username:password
where the password is the encrypted format of the password. To encrypt the password you will either need to use one of the premade scripts available on the web or write your own. There is a good username/password service at the KxS site which will allow you to enter the user name and password and will output it in the correct format.
“password”的位置應該是加密過的密碼。你可以通過幾種方法來得到加密過的密碼：一是使用一個網上提供的permade腳本或自己寫一個；另一個很不錯的username/password加密服務是通過KxS網站，這裏允許你輸入用戶名及密碼，然後生成正確格式的密碼。

For multiple users, just add extra lines to your .htpasswd file in the same format as the first. There are even scripts available for free which will manage the .htpasswd file and will allow automatic adding/removing of users etc.
對於多用戶，你只需要在.htpasswd文檔中新增同樣格式的一行即可。另外還有一些免費的腳本程序可以方便地管理.htpasswd文檔，可以自動新增/移除用戶等。

Accessing The Site 訪問網站

When you try to access a site which has been protected by .htaccess your browser will pop up a standard username/password dialog box. If you don't like this, there are certain scripts available which allow you to embed a username/password box in a website to do the authentication. You can also send the username and password (unencrypted) in the URL as follows:
當你試圖訪問被.htaccess密碼保護的目錄時，你的瀏覽器會彈出標準的username/password對話窗口。如果你不喜歡這種方式，有些腳本程序可以允許你在頁面內嵌入username/password輸入框來進行認證，你也可以在瀏覽器的URL框內以以下方式輸入用戶名和密碼（未加密的）：

[url]http://username:[email protected]/directory/[/url]
Summary 小結

.htaccess is one of the most useful files a webmaster can use. There are a wide variety of different uses for it which can save time and increase security on your website.
.htaccess是一個站點管理員可以應用的一個強大的工具，有更多的變化以適應不同的用途，可以節約時間及提高網站的安全性。