which server variables from this list can be spoofed?
| From: | Haluk Karamete | Date: | Fri, 20 Jan 2012 02:07:45 +0000 |
| Subject: | which server variables from this list can be spoofed? | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-316340@lists.php.net to get a copy of this message | ||
I marked those I already know as "can",
$_SERVER['REMOTE_ADDR'] CAN
$_SERVER['HTTP_REFERER'] CAN
$_SERVER['HTTP_USER_AGENT'] CAN
$_SERVER['REQUEST_URI'] CAN ( cause it contains the query string
part and user/hacker can easily change that )
Those I'm not too sure are as follows;
$_SERVER['SERVER_NAME']
$_SERVER['DOCUMENT_ROOT']
$_SERVER['SCRIPT_NAME']
$_SERVER['PHP_SELF']