----- Original Message -----
From: "James Keeline"
> --- Bob < helldrivers%40gmail.com">helldrivers
gmail.com> wrote:
<snipped code>
>> Hi James,
>> If you create a file:
>> <?php
>> header('HTTP/1.0 404 Not Found');
>> ?>
>> or even
>;> <?php
>> header("HTTP/1.0 404 Not Foundrnrn");
>> ?>
>>
>>; And call it with IE, it displays the standard 404 error page.
>> If you call it with either FF or Opera, it displays a blank page.
>> As FF and Opera have found the page, it seems that they ignore the header,
>> although it will probably still be sent.
>> The only way the 404 error page comes up in FF and Opera (it seems) is if
>> there is a genuine no page found.
>>
>>; So, I may have to use a fake reproduction for FF and Opera?
>>
>>; IE needs (I think it's 256 or 1024 bytes) to show a custom page.
>> I actually use that to my advantage, so genuine users get a informative page,
>> but someone who includes "?" "=" or "&;" and a few other things gets a blank
>> page in my custom error routine.
>>
>>; If you exit; immediately (or before 256 bytes) from header, IE displays it's
>;> standard 404 page.
>> More that 256 or 1024 (I can't remember) it will display your custom page.
>> It seems that Microsoft did have a reason for doing this.
>> Regards, Bob.
>;
>
> I would use the technique I mentioned -- a .htaccess file in the directory with
>; the web pages containing an ErrorDocument statement that points to a PHP page
>; with your custom handler for the 404 (ie 404.php). You could have the program
> look at the full URL and take appropriate actions depending on your ingenuity.
>
> The minimum number of bytes for a custom error page displaying in IE is a well
>; known problem. You just need to fill it up with large HTML comments <!-- -->
> or tags that don't print anything. It's inconvenient but so is working with IE
> in many respects. FF should show even small custom error pages.
>
> Of course, the .htaccess technique requires Apache and some configuration
> details which allow you to use it.
Hi James,
That's what I'm doing already 
All my custom error pages include the site's header title image, links and footer, which is approx 12K.
If it has "?", "&;", "=", "%", "_vti_" etc. and a bunch of other common hacks, they get a blank page.
http://www.circlecity.co.uk/non-existant-page.php
http://www.circlecity.co.uk/non-existant-page.php?xyz=nastycode
Try the 2 links with IE, then with either FF or Opera.
The problem was how to bring up FF or Opera's 404 error page.
IE does exactly as I want it to.
In my experience with hackers, they very rarely use IE.
It would have been nice to feed them a genuine error page, instead of a blank page.
Any new attempts would probably give up and leave, but if they see a blank page, they know they've got somewhere and will probably try some more.
One thing I've just thought of is redirecting to a non-existant page.
Regards, Bob.
.
