tags:

views:

748

answers:

5

Is there any easy way to identify the file initially requested by the user, ignoring get arguments and handling (at least basic) mappings like / to /index.php?

Ideally what I'm looking for is something like $_SERVER['REQUEST_URI'], except it returns the same value regardless of the get arguments and that value is the file requested, not the uri, nor the currently executing file ($_SERVER['PHP_SELF']). In other words, a $_SERVER['REQUESTED_FILE'] or something. I haven't seen anything like that, does it exist, or do I need to write something manually?

Update Here are some example urls paired with what I would like the result to be:

example.com/mypage.php       : /mypage.php
example.com/                 : /index.php
example.com/foo/?hello=world : /foo/index.php

And these return values are true even in included files. See my answer below before answering, I think I've found what I was looking for.

+2  A: 
$_SERVER['PHP_SELF']

Should return the actual script. But there are various methods.

I had a better link to a matrix of all the various file-related environment variables but I can't find it. I'll edit if it turns up.

Edit: I found a nice SO thread that details the differences between them.

Oli
A: 
  1. parse_url($_SERVER['REQUEST_URI']) and then pathinfo($path) to get requested filename
  2. $_SERVER['PHP_SELF'] to get real filename
  3. $_SERVER['SCRIPT_NAME'] to get real filename
Jet
A: 

You are probably looking for $_SERVER['PATH_INFO']

You can also do some other fancy things with it

Shoan
I don't think so. $_SERVER['PATH_INFO'] only displays the content *after* the file, which is basically the opposite of what I'm looking for.
dimo414
A: 

$_SERVER['PHP_SELF'] is subject to security vulnerabilities. Use with GREAT caution.

Flavius
The security vulnerability is that malicious users can inject content after the actual file path, yes? That seems to me to indicate that PHP_SELF doesn't do what I want...
dimo414
Exactly. The "script" can be: http://host.tld/index.php/%22%3E%3Cscript%3Ealert('xss')%3C/script%3E%3Cfoo
Flavius
A: 

Since this is apparently not well known, I decided to test it out myself. The $_SERVER['SCRIPT_NAME'] variable serves up the path to the requested file, even if it's an index file, and without get parameters or anything else. The PHP documentation states this contains the path of the file, but it seems to me to be relative to the Document root, just like PHP_SELF, but without the security vulnerability.

Here is the code I used to test this:

index.php:

<?php include 'pathtest.php'; ?>

pathtest.php:

<?php

echo __FILE__.'<br />';
echo $_SERVER['PHP_SELF'].'<br />';
echo $_SERVER['SCRIPT_NAME'].'<br />';
echo $_SERVER['REQUEST_URI'].'<br />';
echo $_SERVER['PATH_INFO'].'<br />';
echo parse_url($_SERVER['REQUEST_URI'],PHP_URL_PATH).'<br />';

echo '<br /><br />';

include 'pathtest2.php';

?>

pathtest2.php:

<?php

echo __FILE__.'<br />';
echo $_SERVER['PHP_SELF'].'<br />';
echo $_SERVER['SCRIPT_NAME'].'<br />';
echo $_SERVER['REQUEST_URI'].'<br />';
echo $_SERVER['PATH_INFO'].'<br />';
echo parse_url($_SERVER['REQUEST_URI'],PHP_URL_PATH).'<br />';

?>
dimo414