Understanding the Difference Between php _server http_host vs server_name

Greetings, Dev! In this article, we will be exploring the differences between two commonly used PHP server variables: $_SERVER[‘HTTP_HOST’] and $_SERVER[‘SERVER_NAME’]. These variables play an important role in web development, especially when it comes to setting up virtual hosts or accessing domain names. Let’s dive in!

What is $_SERVER[‘HTTP_HOST’]?

$_SERVER[‘HTTP_HOST’] is a server variable that contains the domain name of the current HTTP request. This means that if a user requests a page on your website, $_SERVER[‘HTTP_HOST’] will give you the domain name that was used to access that page. This variable is often used for setting up virtual hosts, as it allows you to differentiate between multiple domains that are hosted on the same server.

For example, let’s say you have two websites hosted on the same server: example.com and test.com. When a user requests a page on example.com, $_SERVER[‘HTTP_HOST’] will return “example.com”. Similarly, when a user requests a page on test.com, $_SERVER[‘HTTP_HOST’] will return “test.com”. This allows you to configure different settings for each domain, such as setting up different databases or using different templates.

How to Use $_SERVER[‘HTTP_HOST’]

Here’s an example of how you can use $_SERVER[‘HTTP_HOST’] in your PHP code:

What is $_SERVER[‘SERVER_NAME’]?

$_SERVER[‘SERVER_NAME’] is another server variable that contains the domain name of the current HTTP request. However, unlike $_SERVER[‘HTTP_HOST’], $_SERVER[‘SERVER_NAME’] returns the official name of the server that is hosting the website. This means that if a user requests a page on your website, $_SERVER[‘SERVER_NAME’] will give you the name of the server that is hosting your website.

How to Use $_SERVER[‘SERVER_NAME’]

Here’s an example of how you can use $_SERVER[‘SERVER_NAME’] in your PHP code:

Differences Between $_SERVER[‘HTTP_HOST’] and $_SERVER[‘SERVER_NAME’]

Now that we have an understanding of what each server variable does, we can explore the differences between them. Here are some of the key differences:

1. $_SERVER[‘HTTP_HOST’] can be manipulated

One of the key differences between $_SERVER[‘HTTP_HOST’] and $_SERVER[‘SERVER_NAME’] is that $_SERVER[‘HTTP_HOST’] can be manipulated by the user. This means that if a user sends a request with a modified HTTP Host header, the $_SERVER[‘HTTP_HOST’] variable will contain the modified domain name.

For example, a user may try to access your website using the IP address of your server rather than the domain name. If this happens, $_SERVER[‘HTTP_HOST’] would contain the IP address rather than the domain name.

2. $_SERVER[‘HTTP_HOST’] includes the port number

Another key difference between $_SERVER[‘HTTP_HOST’] and $_SERVER[‘SERVER_NAME’] is that $_SERVER[‘HTTP_HOST’] includes the port number if one is used in the request. This means that if a user sends a request to your website using a non-standard port (e.g. http://example.com:8080), $_SERVER[‘HTTP_HOST’] will contain the port number as well as the domain name.

On the other hand, $_SERVER[‘SERVER_NAME’] does not include the port number, and will only contain the name of the server.

3. $_SERVER[‘SERVER_NAME’] is more reliable

Finally, $_SERVER[‘SERVER_NAME’] is generally considered to be more reliable than $_SERVER[‘HTTP_HOST’]. This is because $_SERVER[‘SERVER_NAME’] is set by the server itself, whereas $_SERVER[‘HTTP_HOST’] is set by the user.

For example, if you are using a reverse proxy to serve your website, $_SERVER[‘HTTP_HOST’] may contain the name of the proxy server rather than the name of your server. This can cause issues with virtual hosts and other settings that rely on the domain name.

FAQs

Q. Which should I use: $_SERVER[‘HTTP_HOST’] or $_SERVER[‘SERVER_NAME’]?

A. It depends on your specific use case. If you need to differentiate between multiple domains that are hosted on the same server, $_SERVER[‘HTTP_HOST’] is the better choice. On the other hand, if you need to reliably determine the name of the server that is hosting your website, $_SERVER[‘SERVER_NAME’] is the better choice.

Q. Can $_SERVER[‘HTTP_HOST’] be spoofed?

A. Yes, it is possible for a user to send a request with a modified HTTP Host header. This can cause issues with virtual hosts and other settings that rely on the domain name.

Q. Does $_SERVER[‘HTTP_HOST’] include the port number?

A. Yes, $_SERVER[‘HTTP_HOST’] includes the port number if one is used in the request.

Q. Is $_SERVER[‘SERVER_NAME’] always accurate?

A. No, there are certain edge cases where $_SERVER[‘SERVER_NAME’] may not be accurate. For example, if you are using a reverse proxy to serve your website, $_SERVER[‘SERVER_NAME’] may contain the name of the proxy server rather than the name of your server.

Conclusion

That’s it for our exploration of $_SERVER[‘HTTP_HOST’] and $_SERVER[‘SERVER_NAME’]. While these server variables may seem similar at first glance, there are some key differences that you should be aware of when developing your web applications. By understanding these differences, you can ensure that your code is not only functional, but also secure and reliable.