Why does $_SERVER["SERVER_NAME"]
not echo the www
in www.example.com
but it does work when I echo it from a sub domain like test.example.com
?
views:
183answers:
1
+5
A:
I don’t know why it doesn’t contain the expected value. But try $_SERVER['HTTP_HOST']
instead, that contains the value provided by the client in the HTTP header field Host. But see Chris Shiftlett’s SERVER_NAME
Versus HTTP_HOST
for security considerations.
Gumbo
2009-09-26 17:51:28
So, is HTTP_HOST safer than SERVER_NAME?
Andres
2009-09-26 18:05:31
+1, interesting link investigating the differences in detail
Paul Dixon
2009-09-26 18:07:11
@Andreas: No, both are vulnerable, as the linked article describes. You should validate that values before using them. See also http://stackoverflow.com/questions/1459739
Gumbo
2009-09-26 18:09:00