Security concerns regarding $_SERVER

[Mike Kypriotis]

I have a dual language site where I get the contents I want based on an lang var I pass to the url e.g. index.php?lang= en or index.php?lang= gr (I pass that variable to a SESSION one so i do not have to write it in each url). So in order to be able to change it I need to get the current URL I am using PHP with

$protocol = strpos(strtolower($_SERVER['SERVER_PROTOCOL']),'https') === FALSE ? 'http' : 'https';
$host = $_SERVER['HTTP_HOST'];
$uri = $_SERVER['REQUEST_URI'];
$currurl = $protocol.'://'.$host.$uri;

some questions;
a) is $_SERVER['HTTP_HOST'] safe to use without any escaping I mean i do not see how it could be exploited?
b)$_SERVER['REQUEST_URI'] is vulnerable to XSS attacks so lots of people recommend htmlspecialchar s(), however in a wordpress forum a developer wrote
"A naked htmlspecialchar s() won’t protect you completely.
Consider a form with htmlspecialchar s($_SERVER['PHP_SELF']) as the action, enclosed with single quotes. This will defeat it:

script.php/'%20onmouseover='alert(document.cookie)'

"
it seemed valid what do u thing? I always used htmlspecialchar s() with ENT_QUOTES is there something better?

c)to get the current URL and put it to an href after some manipulation you would use PHP or Javascript (in order for the server not to have unecessery load)?

[jdstankosky]

If you're using session variables, I don't understand why you even need the URL to begin with.

session_start();

if (isset($_GET['lang'])) {
	$_SESSION['lang'] = $_GET['lang'];
} elseif (!isset($_SESSION['lang'])) {
	$_SESSION['lang'] = 'en';
}

getLanguageContents($_SESSION['lang']);

[Mike Kypriotis]

When the user is in a page e.g. www.mypage.com/index.php?page=2&id=3 and clicks the e.g. greek flag i do not want to redirect him to index.php?lang= gr but to www.mypage.com?page=2&id=3&lang=gr so u have to know the current URL in order to append (or replace) the lang variable which is used to define language

[jdstankosky]

So you don't know which $_GET variables they will have when they change their language? Have you tried setting environment variables to help against XSS? Perhaps htmlentities() will give you more control over the contents of your uri vs htmlspecialchar s()?