How do I change this code to use request_uri()?

Question

I'm trying to write a patch to make a module follow the Drupal coding standards.

I get this complain and I don't know how to fix it.

Line 148: the use of REQUEST_URI is prone to XSS exploits and does not work on IIS; use request_uri() instead [security_12] return "http" . (isset($_SERVER['HTTPS']) ? "s" : "") . "://" . "{$_SERVER['HTTP_HOST']}{$_SERVER['REQUEST_URI']}";

The function using that code is the following one.

function module_get_url() {
   return "http" . (isset($_SERVER['HTTPS']) ? "s" : "") . "://" . "{$_SERVER['HTTP_HOST']}{$_SERVER['REQUEST_URI']}";
}

Should I change the code to the following one?

function module_request_uri() {
  return "http" . (isset($_SERVER['HTTPS']) ? "s" : "") . "://" . "{$_SERVER['HTTP_HOST']}{$_SERVER['REQUEST_URI']}";
}

Answer 1

It means replace $_SERVER['REQUEST_URI'] with request_uri().

So module_get_url() needs to change slightly.

function module_get_url() {
  $uri = request_uri();
  return "http" . (isset($_SERVER['HTTPS']) ? "s" : "") . "://" . "{$_SERVER['HTTP_HOST']}{$uri}";
}

Answer 2

Simply swap out $_SERVER['REQUEST_URI'] with request_uri().

The reasoning is that $_SERVER['REQUEST_URI'] is Apache specific.

From the function documentation page:

Returns the equivalent of Apache's $_SERVER['REQUEST_URI'] variable.

Because $_SERVER['REQUEST_URI'] is only available on Apache, we generate an equivalent using other environment variables.

Answer 3

Try:

function module_get_url() {
  return url(current_path(), array('absolute' => true));
}