Is it safe to use $_SERVER[‘REQUEST_URI’]?

$_SERVER['REQUEST_URI'] will not be empty in WordPress, because it is filled in wp_fix_server_vars() (file wp-includes/load.php).

This function is called in wp-settings.php before any plugin is loaded. So you can use it.

But always escape the value. It is global and can be changed by any other code, so you cannot trust its value.

A different case is accessing the value per

filter_input(INPUT_SERVER, 'REQUEST_URI'); 

The write access by WordPress will not affect the value, because filter_input() is always taking the original value. So while this is the more modern and clean approach, it might fail in some circumstances. See also this thread on Stack Overflow.

Leave a Comment