Menu
I have a database full of website urls, the primary key is the $_SERVER["HTTP_HOST"] of the website.
When a user navigates to ... lets say www.my-epic-example-url.com, It will connect the the database and use the $_SERVER["HTTP_HOST"] of that websites, then fetches all the data referencing that website!
What I want to know is, how safe is $_SERVER["HTTP_HOST"] ?
Can it be externally modified?
The only reason i ask is because i read an artical a while back ( cant remember where it was ) saying be careful when using $_SERVER because it is unsafe...
Is this true?
640
There are only values that the server controls and values that the user controls and you need to be aware of where a value comes from and hence whether it can be trusted for a certain purpose. $_SERVER['HTTP_FOOBAR'] for example is entirely safe to store in a database, but I most certainly wouldn't eval it.
$_SERVER['HTTP_HOST'] Returns the Host header from the current request. $_SERVER['HTTP_REFERER'] Returns the complete URL of the current page (not reliable because not all user-agents support it)
It is not always defined. As quoted above, it is only defined if there is a http request. If you are running the php script from CLI (e.g php filename. php) the HTTP_HOST key will not be set.
The $_SERVER['SERVER_ADDR'] returns the IP address (Internet Protocol address) of the host server. Following php code used $_SERVER['SERVER_ADDR'] to display the IP address of the host server.
$_SERVER["HTTP_HOST"] is the HTTP Host header, as sent from the client. That makes this header generally unsafe.
But, if you are in a typical virtual host setup in which the web server decides which script to execute based on VirtualHost configurations, which in turn are triggered by the HTTP Host header, your script should not get executed unless a known, whitelisted value was received in that header.
If the web server does not care about the Host header and executes a certain script for any and all requests, then this value could be absolutely anything.
200
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
