PHP login redirect security
The way you're doing it has advantages over a session based redirect because you have the ability to link people directly to that login with redirect URL.

The disadvantage is phishing as you pointed out.

http://www.mysite.com/login.php?dest=http://mysite.phishing.com/


The way you're doing this, using $_SERVER['REQUEST_URI'] means you expect the $_GET['dest'] to only include a path, not a domain.

So you could add a check in the login page where it sets the $dest

$dest = "./";
if(isset($_GET["dest"]))
{
    $parts = parse_url( $_GET['dest'] );

    // if there is no `host` key set in the parse_url array, then its an internal path
    // so set the new $dest
    if( !isset( $parts['host'] ) )
    {
        $dest = $_GET["dest"];
    }
}