note 80045 deleted from function.getenv by danbrown
| From: | danbrown@php.net | Date: | Sun, 20 Jul 2008 00:19:55 +0000 |
| Subject: | note 80045 deleted from function.getenv by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-141835@lists.php.net to get a copy of this message | ||
Note Submitter: simon at ruderich dot com
----
I just checked it and it looks like $_SERVER['SERVER_NAME'] can't be faked by sending
a wrong 'Host:' header (at least with Apache 1.3).
But $_SERVER['HTTP_HOST'] can be faked. To test this use telnet and send the following
request (it will also work with HTTP/1.1):
GET /test.php HTTP/1.0
Host: my-test-host
To this script:
<?php
echo $_SERVER['SERVER_NAME'] . "\n";
echo $_SERVER['HTTP_HOST'] . "\n";
?>
This will return:
the-real-server-name
my-test-host