title: $_SERVER['REQUEST_URI'] reliability?
body: <p>In one of my websites I use <code>$_SERVER['REQUEST_URI']</code> to establish whether a non-registered user can see the content of a page or not.</p>
  
  <p>In the manual there is written about <code>$_SERVER['REQUEST_URI']</code>:</p>
  
  <blockquote>
    <p>The URI which was given in order to access this page; for instance,
    '/index.html'.</p>
  </blockquote>
  
  <p>My question is, is it in any client side way possible for a client to access eg. index.php even though <code>$_SERVER['REQUEST_URI']</code> contains a different value?</p>
  
  <p>I know that <code>$_SERVER['REQUEST_URI']</code> contains the page that the client asked and that the server returns but if I don't ask myself these kind of questions once in a while I'm not happy</p>
  
  <p>Also is it considered good practice to use <code>$_SERVER['REQUEST_URI']</code> in this way?</p>
  
  <p><strong>EDIT: I included the script I use as it was too generic</strong></p>
  
  <pre><code>list($c_page) = explode('.',substr($_SERVER['REQUEST_URI'],1));
  define('C_PAGE',$c_page ?: 'index');
  define('LOGGED',$_SESSION['user']['id'] ?: 0);
  if(in_array(C_PAGE,array('page_1','page_2','page_3')) &amp;&amp; !LOGGED){ header('Location: login.html'); exit; }
  </code></pre>