Difference between these 2 urls.

Question

In my PDO study I came across the following: I have a URL like: www.site.com/admin/index? dir=article/create

How I created a . php removal function from the files in the above URL navigation did not work.

So I decided to replace "?" with "&" and remove . php from the URL, thus:

www.site.com/admin/index&dir=article/create

And it worked, it looked in the article folder the create file and rendered to me. How can this affect my website? Security can be compromised? I appreciate any feedback.

Answer 1

If you are using the Apache WEB server, probably the option Multiviews is active, in which case it is possible to ignore the file extension and Apache itself will determine which is the most appropriate file to be called.

This will not interfere with application security.