$_SERVER["REQUEST_URI"] is it secure?

Question

i have a question about these function: $_SERVER["REQUEST_URI"]. Can somebody tell me if it's safe to use like i use it ( these form i use for new topic in forum )?

<form name="vpid" action="<?php echo htmlspecialchars($_SERVER["REQUEST_URI"]);?>"  method="post">

Thank you

Answer 1

The first thing I'd say is that you probably don't need REQUEST_URI in this in this context.

If you want a form to post back to the current page, the action attribute can be set to blank string or a dot; you don't need to specify the whole current URL.

In cases where you do need it, the answer is that yes, REQUEST_URI is safe.

A lot of values in $_SERVER are not safe, so it's good to be cautious, but REQUEST_URI is safe because it represents the address that was used to get to the site; if the address is invalid, then the user wouldn't have been able to get to the server in the first place.

Other $_SERVER fields can be hacked; it's trivial to spoof things like REMOTE_HOST and HTTP_REFERER, so you should never rely on them to be reliable, but REQUEST_URI ought to be safe.

The main thing here though is that you shouldn't really need it anyway.