Correct. However, since the regex patterns are stored in the DB, put there by trusted users, it is effectively the same as hard coding them (without having to). $ENV{REQUEST_URI} can be mucked with without any security issues (the replacement will just fail).