I wrote:
It's easy enough to find out if REQUEST_URI is
available. What we
don't know is whether REQUEST_URI is really what was sent to the
server, or whether it has %2E converted to "." before PHP gets to see it.
I installed IIS on my Windows VM and checked this. I installed PHP
from the MSI installer, which uses FastCGI by default.
REQUEST_URI is indeed mangled on IIS. There's no way to tell if %2E
was sent by the browser.
-- Tim Starling