Does request_uri() have to be filtered or escaped? Mind my ignorance, but I'm trying to understand whether or not calling request_uri(), and then echoing output from it into a link is safe.

What I'm doing is getting arguments from the URL, for example:

$exploded_url = explode('/', request_uri());
echo $exploded_url[3];


My questions: is this function's output being escaped/filtered already? Would it be overkill for me to do it again? What would be the way to ensure that it is safe? Is there another/better function I should or could use?

Thanks, any input is appreciated!
The short answer is yes, you need to sanitise the variable yourself.

All request_uri() does is pass the raw input from $_SERVER['REQUEST_URI'] (or from a different source if the server is not Apache). Apache/PHP does nothing by default to sanitise the $_SERVER variables on your behalf so they should be considered unsafe.

There's an excellent answer to Which $_SERVER variables are safe on StackOverflow that goes into a lot more detail, and actually notes that REQUEST_URI "may contain tainted data".