What is the proper way to make your url "nicer"? - .htaccess

Question

recently i have tried to build some MVC application without any framework to understand MVC pattern better. Till now i have resolved every problem i have had BUT....
Pretty common thing is to make your URL looks "nicer"
For example www.somesite.com/controller/method
instead of www.somesite.com/index.php?c=1&m=2.
i achieved this simply with htacces by aiming it to a variable.
in htaccess...RewriteRule ^(.*)$ index.php?url=$1 [QSA,L]
This works perfectly fine until someone tries to rewrite variable "url".
Basically if someone types www.somesite.com/controller/method?url=1
my Application will pop up an error page because i am parsing everything after / and calling specific controllers and methods by its name (or popping up an error page if that doesnt exists).
So i would like to know if there is a better way to do this or way to avoid this behaviourThanks :)
EDIT
In last few hours i tried to find a better solutions. I thought i could put my url into Enviromental variable instead of into get variable.
So i experimented with commands like
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-l
RewriteRule ^(.*)$ index.php [E=URL:$1,QSA]
unfortunately $_SERVER["URL"] is blank......
i would be really happy if someone could help me with this piece of code :) Thanks
EDIT 2
Okay to make it clear i'll add few examples.
My current htacces looks like this
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-l
RewriteRule ^(.*)$ index.php?url=$1 [QSA]
So if someone goes to www.somesite.com/foo/bar
i will check $_GET["url"] and then explode it explode("/", filter_var(rtrim($_GET["url"], "/"), FILTER_SANITIZE_URL))
Now i have array which looks like [0=>foo 1=>bar]
That means in my code that i will try to call controller called foo and then method in this class called bar
In case that the user will try to acces www.somesite.com/foo/bar/fee/faa, fee and faa will pass as a parameters to method bar in class foo.
So this was just example how does this work. My problem is as i said when someone tries to acces lets say www.somesite.com/foo?url=0. Then my script will try to handle $_GET["url"] and the result wont be foo but 0 because of ?url=0 rewrites the value of url which was originaly set in my .htacces. So my scripts will try to call controller called 0 and if that doesnt exists itt will popup error404. I have already tried to ignore this specific variable via QUERY_STRING in htacces but this seems to me like a stupid solution. For now i would like to stick with setting evniromental variable instead of get variable or if there is some better way to achieve this :) Thanks

Answer 1

Your current set-up relies on $_GET to obtain core information but, as you've faced, that variable is populated from user input so anyone can mess with your routing, even inadvertently.
A typical Apache configuration for a custom router looks like this (this snippet is from CakePHP/2.x):
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^ index.php [L]
</IfModule>
As you can see is doesn't add GET variables of its own, it merely lets existing ones to pass through. Original URL is right there inside $_SERVER, you don't need to instruct Apache to copy it into the redirected URL.
I understand you want $_SERVER['REQUEST_URI'] but you can peek inside the array with the usual methods: print_r($_SERVER), var_dump($_SERVER), phpinfo()...