note 80045 added to function.getenv

I just checked it and it looks like $_SERVER['SERVER_NAME'] can't be faked by sending a wrong 'Host:' header (at least with Apache 1.3). But $_SERVER['HTTP_HOST'] can be faked. To test this use telnet and send the following request (it will also work with HTTP/1.1): GET /test.php HTTP/1.0 Host: my-test-host To this script: <?php echo $_SERVER['SERVER_NAME'] . "\n"; echo $_SERVER['HTTP_HOST'] . "\n"; ?> This will return: the-real-server-name my-test-host ---- Server IP: 217.160.72.57 Probable Submitter: 84.148.204.79 ---- Manual Page -- http://www.php.net/manual/en/function.getenv.php Edit -- https://master.php.net/note/edit/80045 Del: integrated -- https://master.php.net/note/delete/80045/integrated Del: useless -- https://master.php.net/note/delete/80045/useless Del: bad code -- https://master.php.net/note/delete/80045/bad+code Del: spam -- https://master.php.net/note/delete/80045/spam Del: non-english -- https://master.php.net/note/delete/80045/non-english Del: in docs -- https://master.php.net/note/delete/80045/in+docs Del: other reasons-- https://master.php.net/note/delete/80045 Reject -- https://master.php.net/note/reject/80045 Search -- https://master.php.net/manage/user-notes.php