Execute PHP code before any files using .htaccess

Not sure if this is the right place for this, but I need to be able to run some PHP code before anything loads up on the server.
So far I have a .htaccess file with the following in it:

Code:

---

Options +FollowSymLinks
RewriteEngine On
RewriteBase /
RewriteRule (.*) auth.php?torun=$1 [QSA]

---

And in auth.php I have this:

PHP Code:

---

<?php
$method="http";
$domain="example.com";


error_reporting(E_ALL);
ini_set('display_errors', 1);


if ($_GET['grantaccess']=="true") {
  $url=$method . '://' . $domain . '/' . $_GET['torun'];
  unset($_GET['torun']);
  unset($_GET['grantaccess']); //Comment out to prevent loop
  if (count($_GET) >= 1) {
    $queryString = "?" . http_build_query($_GET);
  } else {
    $queryString = "";
  }
  //header ( 'Location: ' . $url . $queryString);
  printf ( 'Location: ' . $url . $queryString);
} else {
  echo "Access denied";
}

---

So far it's working right up to the point where it runs header function. Once that's run there are 1 thing that goes wrong:
It re-executes the .htaccess file again (Which will cause an infinite loop if the "grantaccess" query string is put on). I basically want to somehow disable it re-executing the .htaccess file, or make it only run once per page load/connection.

Edit:
Fixed one of the problems myself, and updated the code.

Here is my code solution. I'm not sure how secure this will be (Obviously $_GET['grantaccess']=="true" is going to be changed), any comments would be appreciated:

PHP Code:

---

<?php

error_reporting(E_ALL);
ini_set('display_errors', 1);

$method="http";
$domain="example.com";

$defaultMIME="text/plain";

$fileType = $defaultMIME;

if ($_GET['grantaccess']=="true") {
  $navFile=str_replace("..", "", $_GET['torun']);
  $fileURL=$method . '://' . $domain . '/' . $navFile;

  if (file_exists($navFile)) {
  
    $finfoHandler = finfo_open(FILEINFO_MIME_TYPE);
    $fileType = finfo_file($finfoHandler, $navFile);
    finfo_close($finfoHandler);
    
    if ($fileType===FALSE) {
      $fileType = $defaultMIME;
    }
    
    header('Content-Type: '.$fileType);

    $fileHandle = fopen($navFile, "r");
    //$fileContents = stream_get_contents($fileHandle); //Can't use a URL with fopen, it will reexecute .htaccess.
    $fileContents = fread($fileHandle, filesize($navFile));
    fclose($fileHandle);
    
    echo $fileContents;
    
  } else {
    header("HTTP/1.0 404 Not Found", true, 404);
    echo "Not Found";
  }
  
} else {
  header("HTTP/1.0 403 Forbidden", true, 403);
  echo "Access denied";
}

---

I only wanted to give access to sub-directories from here, not anything above / when navigating from browser. I believe Apache is Chrooted anyway when you specify the virtual host's document root in the config, but I replaced all ".." with nothing just to be sure.

please tell me what is the use of this script?