Last updated: August 26, 2026.
Build the current URL from a configured public origin and the request URI. A fixed origin avoids trusting a forged Host header.
Current path and query string
<?php
$requestUri = (string) ($_SERVER['REQUEST_URI'] ?? '/');
$pathAndQuery = str_starts_with($requestUri, '/') ? $requestUri : '/';
$currentUrl = 'https://www.example.com' . $pathAndQuery;Reusable function
<?php
function currentUrl(string $publicOrigin): string
{
$origin = rtrim($publicOrigin, '/');
$uri = (string) ($_SERVER['REQUEST_URI'] ?? '/');
return $origin . (str_starts_with($uri, '/') ? $uri : '/');
}
echo htmlspecialchars(currentUrl('https://www.example.com'), ENT_QUOTES, 'UTF-8');If the application runs behind a proxy, configure the public origin in application settings. Trust forwarded scheme and host headers only from a known proxy. Use parse_url() when only the path or query is required.
