How to safely get full URL of parent directory of current PHP page

Question

I'm using:

$domain = $_SERVER['HTTP_HOST'];
$path = $_SERVER['SCRIPT_NAME'];
$themeurl = $domain . $path;

But this of course gives the full URL. Instead I need the full URL minus the current file and up one directory and minus the trailing slash.

so no matter what the browser URL domain is eg localhost, https://, http://, etc that the full real (bypassing any mod rewrites) URL path of the parent directory is given without a trailing slash.

How is this done? Safely so no XSS as I guess (from reading) using anything but 'SCRIPT_NAME' has such risk.. not sure though ofc.. just been reading a ton trying to figure this out.

examples: if given:

https://stackoverflow.com/questions/somequestions/index.php

need:

https://stackoverflow.com/questions

without the trailing slash.

and should also work for say:

http://localhost/GetSimple/admin/load.php

to get

http://localhost/GetSimple

which is what I'm trying to do.

Thank you.

---

---

Edit: Here's the working solution I used:

$url  = isset($_SERVER['HTTPS']) ? 'https://' : 'http://';
$url .= $_SERVER['SERVER_NAME'];
$url .= htmlspecialchars($_SERVER['REQUEST_URI']);
$themeurl = dirname(dirname($url)) . "/theme";

it works perfectly.

Answer 1

Thats easy - using the function dirname twice :)

echo dirname(dirname('https://stackoverflow.com/questions/somequestions/index.php'));

---

Also note @Sid's comment. When you you need the full uri to the current script, with protocol and server the use something like this:

$url  = isset($_SERVER['HTTPS']) ? 'https://' : 'http://';
$url .= $_SERVER['SERVER_NAME'];
$url .= $_SERVER['REQUEST_URI'];

echo dirname(dirname($url));

Answer 2

I have more simple syntax to get parent addres with port and url lets try my code

dirname($_SERVER['PHP_SELF'])

with this code you can got a direct parent of adres if you want to 2x roll back directory you can looping

dirname(dirname($_SERVER['PHP_SELF']))

dirname is fungtion to get parent addrest web and $_SERVER['PHP_SELF'] can showing current addres web.

thakyou Sir https://stackoverflow.com/users/171318/hek2mgl

Answer 3

I do not suggest using dirname()as it is for directories and not for URIs. Examples:

• dirname("http://example.com/foo/index.php") returns http://example.com/foo
• dirname("http://example.com/foo/") returns http://example.com
• dirname("http://example.com/") returns http:
• dirname("http://example.com") returns http:

So you have to be very carful which $_SERVER var you use and of course it works only for this specific problem. A much better general solution would be to use currentdir() on which basis you could use this to get the parent directory:

function parentdir($url) {
    // note: parent of "/" is "/" and parent of "http://example.com" is "http://example.com/"
    // remove filename and query
    $url = currentdir($url);
    // get parent
    $len = strlen($url);
    return currentdir(substr($url, 0, $len && $url[ $len - 1 ] == '/' ? -1 : $len));
}

Examples:

• parentdir("http://example.com/foo/bar/index.php") returns http://example.com/foo/
• parentdir("http://example.com/foo/index.php") returns http://example.com/
• parentdir("http://example.com/foo/") returns http://example.com/
• parentdir("http://example.com/") returns http://example.com/
• parentdir("http://example.com") returns http://example.com/

So you would have much more stable results. Maybe you could explain why you wanted to remove the trailing slash. My experience is that it produces more problems as you are not able to differentiate between a file named "/foo" and a folder with the same name without using is_dir(). But if this is important for you, you could remove the last char.

Answer 4

This example works with ports

function full_url($s)
{
    $ssl = (!empty($s['HTTPS']) && $s['HTTPS'] == 'on') ? true:false;
    $sp = strtolower($s['SERVER_PROTOCOL']);
    $protocol = substr($sp, 0, strpos($sp, '/')) . (($ssl) ? 's' : '');
    $port = $s['SERVER_PORT'];
    $port = ((!$ssl && $port=='80') || ($ssl && $port=='443')) ? '' : ':'.$port;
    $host = isset($s['HTTP_HOST']) ? $s['HTTP_HOST'] : $s['SERVER_NAME'];
    return $protocol . '://' . $host . $port . $s['REQUEST_URI'];
}
$themeurl = dirname(dirname(full_url($_SERVER))).'/theme';
echo '<a href="'.htmlspecialchars($themeurl,ENT_QUOTES,'UTF-8').'">Theme URL</a>';

Source: https://stackoverflow.com/a/8891890/175071