REQUEST_URL vs REQUEST_URI

[Daevon]

Hello everyone
Even tho I added some
"first|second|third"
regex to my URL rewrite, some evil bot is still getting to request my pages.

I'm wondering.. what's the difference in the Url Rewrite engine in
REQUEST_URL vs REQUEST_URI?
I've searched all along and the 'official' RFC response is that every URI is an URL (but not vice-versa) and PHP does not possess both concepts.
..nor does Abyss documentation shed some light on the matter.

Any help please?
Thanks!