I am trying to get the current page url which require the use of $_SERVER["REQUEST_URI"].
The point is how do I need to sanitize the returned URL?
I tried to use sanitize_url( string $url, string[] $protocols = null ) on the $pageURL variable but this returned "https" only as a result.
Using sanitize_url on $_SERVER["REQUEST_URI"] directly made the website goes critical error.

What am I doing wrong here?
This is my current code "which is working" but not sanitized:

$pageURL = 'http';
if( isset($_SERVER["HTTPS"]) ) {
    if ($_SERVER["HTTPS"] == "on") {$pageURL .= "s";}
$pageURL .= "://";
if ($_SERVER["SERVER_PORT"] != "80") {
    $pageURL .= esc_html($_SERVER["SERVER_NAME"].":".$_SERVER["SERVER_PORT"].htmlspecialchars
} else {
    $pageURL .= esc_html($_SERVER["SERVER_NAME"].htmlspecialchars($_SERVER["REQUEST_URI"]));

    $parse = parse_url($pageURL);
if($parse !== false)
    return esc_url($pageURL);
else{ __return_false();}

Context: This function will be called in the frontend using a short code to get the page URL

  • 1
    What's the context you're trying to get the page URL? Frontend? Backend? Jun 8, 2022 at 22:15
  • Unrelated, but using __return_false(); like that isn't going to do anything. If you want to return false from your function you need to actually use return. That function is mainly intended as a callback, and isn't meant to be used like this. Jun 9, 2022 at 1:50

1 Answer 1


Good on you for trying to do this properly - but... how about this?

global $wp;
echo esc_url( home_url( $wp->request ) );

EDIT: Versions of your above code have been written all over the internet - see this SO question with 000s of votes. rather UN-intuitively it's not a super simple thing to do as the client can set some of these themselves, so you're right to want to sanitize.

Sanitization is just the removal of anything you're not expecting in your string... You're expecting a URL - so only allow valid URL characters through. If you don't need to echo out query strings - well then you could also remove everything that's not in your page names or site structure. The point is - you decide - there isn't a function that just does sanitize_this() your job is to work out exactly what the limit is for allowing data through. Maybe one of these work? Look at what is permitted through and decide what's right in that use case.

Generally you should only need to sanitize once and escape once to avoid over complication and if you're encoding you don't want to double encode - you could actually be making your code less secure as other functions could be looking for strings such as '<script>' in "decoded" strings and only seeing %3Cscript%3E meanwhile your JavaScript decodes and outputs later on. You see what I mean?

My point above about using wp is that it's already there for you. Re-writing these functions is asking for mistakes, security implications and odd error conditions and dealing with common PHP issues using your own custom functions is naive at best and arrogant at worse - professionals have already done this for you - why do you want to do it again?

Regarding the critical issue you mention - sanitize_url( $_SERVER['REQUEST_URI'] ); is valid markup - sanitize_url() is a WordPress function and will need WordPress to have been loaded to work. Check your logs for the exact cause.

  • Thank you! The main point is how to sanitize $_SERVER["REQUEST_URI"] properly with out loosing parts of the URL?
    – ehab
    Jun 9, 2022 at 19:55
  • @ehab - I've edited my answer to explain a little more - let me know if there's anything you're not clear on
    – Bysander
    Jun 10, 2022 at 12:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.