Does request_uri() have to be filtered or escaped?
The short answer is yes, you need to sanitise the variable yourself.

All request_uri() does is pass the raw input from $_SERVER['REQUEST_URI'] (or from a different source if the server is not Apache). Apache/PHP does nothing by default to sanitise the $_SERVER variables on your behalf so they should be considered unsafe.

There's an excellent answer to Which $_SERVER variables are safe on StackOverflow that goes into a lot more detail, and actually notes that REQUEST_URI "may contain tainted data".