tags:

views:

183

answers:

1

Why does $_SERVER["SERVER_NAME"] not echo the www in www.example.com but it does work when I echo it from a sub domain like test.example.com?

+5  A: 

I don’t know why it doesn’t contain the expected value. But try $_SERVER['HTTP_HOST'] instead, that contains the value provided by the client in the HTTP header field Host. But see Chris Shiftlett’s SERVER_NAME Versus HTTP_HOST for security considerations.

Gumbo
So, is HTTP_HOST safer than SERVER_NAME?
Andres
+1, interesting link investigating the differences in detail
Paul Dixon
@Andreas: No, both are vulnerable, as the linked article describes. You should validate that values before using them. See also http://stackoverflow.com/questions/1459739
Gumbo