note 80147 deleted from function.getenv by nlopess

Note Submitter: ludvig dot ericson at gmail dot com ---- Some say that you can "fake" HTTP_HOST, but not SERVER_NAME (in the $_SERVER superglobal). This is not true because HTTP_HOST is simply what the HTTP header called "Host" contains, possibly sanitized. Yes, the user may have gone to http://example.com/ and set Host: example.org, the server would have no way of telling. The right way to go about it in Apache is to set up a default VHost which just says that there is no site by that name on this server. The default VHost is the first VHost Apache encounters on configuration which isn't tied to a hostname. As for Lighttpd, simply set the server root directory to one where there's only an error message saying there's no such site on the server, and then change the root in every $HTTP["host"] check. Again, you have to realize that HTTP Hosts are only given through a header, there's no other way of knowing. Examples: My main site is at http://lericson.se/ and if you go to a hostname that still directs to my IP address but isn't associated with a site (a webroot) you get an error message, like this: http://does.not.exist.lericson.se/ SERVER_NAME is just which ServerName directive the current VHost has in an Apache configuration (and is as such not available on other SAPIs). Hope that clear things up.