function mso_current_url($absolute = false, $explode = false, $delete_request = false)
{
	$url = getinfo('site_protocol') . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];

	if ($delete_request) {
		// отделим по «?»
		$url = explode('?', $url);
		$url = $url[0];
	}

	if ($absolute) return $url;

	$url = str_replace(getinfo('site_url'), '', $url);
	$url = trim(str_replace('/', ' ', $url));
	$url = str_replace(' ', '/', $url);
	$url = urldecode($url);

	if ($explode) $url = explode('/', $url);

	return $url;
}

The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.