Does the use of
mod_rewrite make PHP array injection (web parameter key tampering) impossible when the keys are unknown (and hard to guess)?
Let's say we have the following URL:
example.com decided to rewrite there URLs to a prettier version like:
Therefor they use the following
RewriteRule ^/product/(.*)$ /product.php?id=$1&action=show [L]
Now the keys are
action and those values are
show. I understand the values will be rewrited, no protection is involved anyhow. Injections are still possible and so on. But the keys cannot be changed assuming they are unknown. In this example I used the guessable keys
action but they could as well be two completely long and random keys.
Now my question is about the keys. I could inject one or multiple
 in the parameter to make that the value of that
id an PHP array instead of string. Like this:
For a rewrited URL their is no way to do so unless you know the key. Am I right? In this example the following will still be possible because they key is easy to guess. The below example the URL will know have the key
id two times and use the last one with the injected
But assuming the keys were not known and easy to guess. Let's say:
RewriteRule ^/product/(.*)$ /product.php?7b8d164d7820713ef5be524d2bde7828999c78d6=$1&28c4abba80b7a2038328e54a81f51367ead9172a=show [L]
I suppose that then there is no way to inject
 without knowing the keys.
Additionally, when you check the current URL in your PHP script for the characters
& you can prevent bypasses like
https://example.com/product/1?id=1. In my opinion then array injection or altering the key is not possible anymore just the value can be changed. Right?