REQUEST_URI is used in php_self(), so make sure it's sanitized too