Is it ok to use PHP's strpos and substr altogether in one statement?
Instead of raw string manipulation, I would use parse_url and parse_str:

&lt;?php

// Note: parse_url is not intended for relative URLs
// (in other words, bare $_SERVER['REQUEST_URI'] will not work -- you'll have to build a full URL)
$url = 'http://mydomain.com/api/format/method?app_id=value&amp;call=encrypted_request';

$path = explode('/', ltrim(parse_url($url, PHP_URL_PATH), '/'));
parse_str(parse_url($url, PHP_URL_QUERY), $query);

$api = array_shift($path);
$format = array_shift($path);
$method = array_shift($path);

$app_id = (isset($query['app_id'])) ? $query['app_id'] : null;
$enc_request = (isset($query['call'])) ? $query['call'] : null;


Yes, this code is a bit longer, but it's more readable to me. Also, raw string manipulation is hazard to failing border cases. If you use a well tested parser, problems less likely.

And, as an added bonus, this routing isn't tied to any globals. Off the top of my head I can't think of a reason, but at some point, it might be useful to be able to route a fake request. It definitely makes unit testing easier.