I wrote:
It's easy enough to find out if REQUEST_URI is available. What we don't know is whether REQUEST_URI is really what was sent to the server, or whether it has %2E converted to "." before PHP gets to see it.
I installed IIS on my Windows VM and checked this. I installed PHP from the MSI installer, which uses FastCGI by default.
REQUEST_URI is indeed mangled on IIS. There's no way to tell if %2E was sent by the browser.
-- Tim Starling