I was unable to find how to get current URL so here's what I've made. Brief tests didn't reveal anything bad. Your thoughts, educated opinions, suggestions, and comment on potential bugs or improvements is highly appreciated!

Especially take a look at $_SERVER['HTTPS'] marked with // ???. I have found many different ways to test for HTTPS and this is the least ugly in my opinion. But still, I'm not sure this is the right way. off/on vs. 0/1 vs. false/true...

HTTPS Set to a non-empty value if the script was queried through the HTTPS protocol. Note: Note that when using ISAPI with IIS, the value will be off if the request was not made through the HTTPS protocol.

If you can, please don't comment at function or variable names. Feel free to rename them to whatever you want, how ever you want.

    default return current url+ruri from $_SERVER
    on false return current url

function current_url ($with_ruri=true) {

    $protocol = isset($_SERVER['HTTPS']) && strtolower($_SERVER['HTTPS']) != 'off' ? 'https' : 'http';  // ???

    $host = trim(filter_var(strip_tags($_SERVER['HTTP_HOST']), FILTER_SANITIZE_URL));

    $uri = $_SERVER['REQUEST_URI'];     // full_uri?with=ruri
    $uri = trim(filter_var(strip_tags($uri), FILTER_SANITIZE_URL));

    if (!$with_ruri) {
        $result = strstr($uri, '?', true);              // trim ?with=ruri
        $uri = $result === FALSE ? $uri : $result;      // if no ? in uri

    $uri = $uri ? urldecode($uri) : $uri;

    $url = $protocol.'://'.$host.$uri;

return $url;

1 Answer 1


I think this might not be a coincidence:

I was unable to find how to get current url so here's what I've made.

The webserver could be behind an SSL endpoint or a load balancer, so $_SERVER values might be modified during the request. I have seen a few web applications where the administrator have to set up the base URL in a config file or configuration page.

Consider the following:

browser -----------> SSL endpoint ----------> HTTP/PHP server
          (https)                   (http)

The browser sends a HTTPS requrest (https://example.com) and it lands at the SSL endpoint which decrypts the request and forwards it to the PHP server which is in an internal network and available at http://internal.example.com/. Note that it's plain HTTP, not HTTPS. The PHP sees it as http://internal.example.com/ but the browser requests another URL: https://example.com.

I've seen some similar infrastructures where the SSL encryption/decryption was moved to another machine for better performance.

  • \$\begingroup\$ Would you be kind to explain your answer in more detail. Why and how could $_SERVER be modified? When my function (potentially) starts to fail? Is this good example of $base_url="http://www.example.com/"; ? \$\endgroup\$
    – CoR
    Mar 27, 2014 at 18:39
  • 1
    \$\begingroup\$ @CoR: See the update please. Let me know if it's not clear and I look for a few more examples. \$\endgroup\$
    – palacsint
    Mar 27, 2014 at 19:01
  • \$\begingroup\$ It's excellent, clear and to the point! If I understand it correctly, there is no automatic cure for this. I must know both servers configuration and architecture... Or I must provide redundant data via get, post or masked somehow in url. And REALLY important question: Is this only setting where $_SERVER might fail? \$\endgroup\$
    – CoR
    Mar 27, 2014 at 19:38
  • 1
    \$\begingroup\$ @CoR: At least I can't come up with any other corner-case. \$\endgroup\$
    – palacsint
    Mar 27, 2014 at 21:23
  • 1
    \$\begingroup\$ Well this is a clear case when I ask a question and get an excellent answer that completely surprise me. Today I've learned something new! Thanks man :) \$\endgroup\$
    – CoR
    Mar 27, 2014 at 21:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.