$_SERVER

$_SERVER is an array filled by the web server. It tells you about the current request and the environment.

Keys you will use often

1
2
3

<?php
echo $_SERVER["REQUEST_METHOD"];   // POST
echo $_SERVER["REQUEST_URI"];      // /contact.php?ref=home

Branching on the method

1
2
3
4
5
6
7
8

<?php
$_SERVER["REQUEST_METHOD"] = "POST";

if ($_SERVER["REQUEST_METHOD"] === "POST") {
    echo "Handle the form";
} else {
    echo "Show the form";
}

1

Handle the form

Keys starting with HTTP_ come from the visitor

Anything starting with HTTP_ is a request header. The visitor controls these completely. That includes HTTP_HOST, HTTP_USER_AGENT, HTTP_REFERER and HTTP_X_FORWARDED_FOR.

• Do not use them for security decisions.
• Do not trust HTTP_HOST to build links in emails. An attacker can send a fake host (called host header injection). Put your real domain in your configuration.
• Escape them before printing (htmlspecialchars()).

The visitor’s IP address

REMOTE_ADDR is the address of whoever connected to the server. Behind a proxy or CDN, that is the proxy’s address, and the visitor’s real address is in a header such as X-Forwarded-For, which can be faked. Only trust that header if the request really came from your own proxy.

Detect HTTPS

1
2
3
4
5
6
7
8
9

<?php
function isHttps(): bool
{
    return !empty($_SERVER["HTTPS"]) && $_SERVER["HTTPS"] !== "off";
}

$_SERVER["HTTPS"] = "on";

var_dump(isHttps());

1

bool(true)

On the command line

In the CLI, $_SERVER["argv"] and $_SERVER["argc"] hold the command line arguments, and most web keys do not exist.