← Back to PHP Course | Chapter 2: Output & Input | Lesson 8 of 8

PHP $_SERVER

Every incoming web request carries a lot of information beyond just the submitted form data -- which URL was requested, what HTTP method was used, what the visitor's IP address is, which server is handling the request. PHP collects all of this into the $_SERVER superglobal array, giving scripts easy access to request and server environment details.

In this page:

  1. Reading Basic Request Information
  2. Identifying the Server and Host
  3. Reading the Visitor's IP Address
  4. Reading HTTP Headers via $_SERVER
  5. Common $_SERVER Keys Reference
Syntax
php 
$_SERVER["REQUEST_METHOD"];   // GET, POST, ...
$_SERVER["REQUEST_URI"];
$_SERVER["HTTP_HOST"];
$_SERVER["REMOTE_ADDR"];

Reading Basic Request Information

$_SERVER["REQUEST_METHOD"] tells you whether the current request was a GET, POST, or another HTTP method, and $_SERVER["REQUEST_URI"] gives you the exact path (and query string) that was requested -- two of the most commonly used $_SERVER keys.

Note: Check $_SERVER["REQUEST_METHOD"] === "POST" at the top of a script that should only process form submissions, to avoid running that logic on a plain page visit.
Warning: $_SERVER["REQUEST_METHOD"] returns the method as an uppercase string like "GET" or "POST" -- comparing against a lowercase string will never match.

Example: Reading Basic Request Information

php 
<?php
// Set `$_SERVER["REQUEST_METHOD"]` to "GET"
$_SERVER["REQUEST_METHOD"] = "GET";
// Set `$_SERVER["REQUEST_URI"]` to "/products?id=5"
$_SERVER["REQUEST_URI"] = "/products?id=5";
// Print `$_SERVER["REQUEST_METHOD"] . " " . $_SERVER["REQUEST_URI"]` to the output
echo $_SERVER["REQUEST_METHOD"] . " " . $_SERVER["REQUEST_URI"];
?>

Identifying the Server and Host

$_SERVER["HTTP_HOST"] gives the domain name the visitor used to reach the site, and $_SERVER["SERVER_NAME"] gives the server's own configured name -- these are useful for building absolute URLs or detecting which domain (in a multi-domain setup) served the current request.

Note: Prefer $_SERVER["HTTP_HOST"] when building links meant to match exactly what the visitor typed, since it reflects the actual domain used in the request.
Warning: $_SERVER["HTTP_HOST"] is technically client-supplied and can be spoofed in unusual configurations -- avoid using it for security decisions without validation.

Example: Identifying the Server and Host

php 
<?php
// Set `$_SERVER["HTTP_HOST"]` to "example.com"
$_SERVER["HTTP_HOST"] = "example.com";
// Set `$_SERVER["SERVER_NAME"]` to "example.com"
$_SERVER["SERVER_NAME"] = "example.com";
// Print `$_SERVER["HTTP_HOST"] . " / " . $_SERVER["SERVER_NAME"]` to the output
echo $_SERVER["HTTP_HOST"] . " / " . $_SERVER["SERVER_NAME"];
?>

Reading the Visitor's IP Address

$_SERVER["REMOTE_ADDR"] holds the IP address the server sees the request coming from -- useful for logging, rate limiting, or geolocation lookups, though it is not a perfectly reliable way to uniquely identify a specific visitor.

Note: Combine $_SERVER["REMOTE_ADDR"] with other signals (like a session ID or account login) if you need a more reliable way to track a specific visitor over time.
Warning: Behind a proxy or load balancer, REMOTE_ADDR often shows the proxy's IP rather than the visitor's real one -- HTTP_X_FORWARDED_FOR (also client-influenced and not fully trustworthy) is sometimes checked as a fallback, with care.

Example: Reading the Visitor's IP Address

php 
<?php
// Set `$_SERVER["REMOTE_ADDR"]` to "192.168.1.10"
$_SERVER["REMOTE_ADDR"] = "192.168.1.10";
// Print `"Request came from: " . $_SERVER["REMOTE_ADDR"]` to the output
echo "Request came from: " . $_SERVER["REMOTE_ADDR"];
?>

Reading HTTP Headers via $_SERVER

Many HTTP request headers are exposed through $_SERVER with an HTTP_ prefix and the header name uppercased with underscores -- $_SERVER["HTTP_USER_AGENT"] holds the browser's user-agent string, and $_SERVER["HTTP_REFERER"] holds the page the visitor came from, if any.

Note: Always run isset() before reading a header-based $_SERVER key, since not every request includes every header.
Warning: HTTP_USER_AGENT and HTTP_REFERER are both fully controlled by the client and can be set to anything (or omitted entirely) -- never treat them as trustworthy for security checks.

Example: Reading HTTP Headers via $_SERVER

php 
<?php
// Set `$_SERVER["HTTP_USER_AGENT"]` to "Mozilla/5.0"
$_SERVER["HTTP_USER_AGENT"] = "Mozilla/5.0";
// Set `$_SERVER["HTTP_REFERER"]` to "https://google.com"
$_SERVER["HTTP_REFERER"] = "https://google.com";
// Print `$_SERVER["HTTP_USER_AGENT"] . "\n" . $_SERVER["HTTP_REFERER"]` to the output
echo $_SERVER["HTTP_USER_AGENT"] . "\n" . $_SERVER["HTTP_REFERER"];
?>

Common $_SERVER Keys Reference

Beyond the keys already covered, a handful of others come up often: SCRIPT_NAME (the currently executing script's path), DOCUMENT_ROOT (the server's web root directory), SERVER_PROTOCOL (the HTTP version used), and QUERY_STRING (everything after the ? in the URL).

Note: When you are not sure a key exists on your server setup, print_r($_SERVER) once during development to see the full, actual list available in your environment.
Warning: The exact set of available $_SERVER keys can differ slightly between web servers (Apache, Nginx, built-in PHP server), so code relying on a less-common key should degrade gracefully if it is missing.

Example: Common $_SERVER Keys Reference

php 
<?php
// Set `$_SERVER["SCRIPT_NAME"]` to "/index.php"
$_SERVER["SCRIPT_NAME"] = "/index.php";
// Set `$_SERVER["DOCUMENT_ROOT"]` to "/var/www/html"
$_SERVER["DOCUMENT_ROOT"] = "/var/www/html";
// Set `$_SERVER["QUERY_STRING"]` to "id=5"
$_SERVER["QUERY_STRING"] = "id=5";
// Print `$_SERVER["SCRIPT_NAME"] . " " . $_SERVER["DOCUMENT_ROOT"] . " " . $_SERVER["QUERY_STRING"]` to the output
echo $_SERVER["SCRIPT_NAME"] . " " . $_SERVER["DOCUMENT_ROOT"] . " " . $_SERVER["QUERY_STRING"];
?>
Related Topics

PHP $GLOBALS · PHP Superglobals · PHP $_REQUEST · PHP $_GET & $_POST

{# common_mistakes/chapter_summary/browser_support: on Hindi pages the view already swaps in the hi_ translation fields (or blanks these out if untranslated), so this renders correctly for both languages without a lang_code check here. #}
Common Mistakes
  1. Trusting $_SERVER values that originate from the client (like HTTP_USER_AGENT or HTTP_REFERER) as though they were guaranteed accurate -- browsers and clients can send whatever values they want for these headers.
  2. Using $_SERVER["REMOTE_ADDR"] as a foolproof way to identify a unique visitor, when proxies, shared networks, and VPNs mean many visitors can share one IP.
  3. Forgetting that not every $_SERVER key is guaranteed to exist on every server setup -- always check with isset() before relying on a less-common key.
Chapter Summary
  • $_SERVER is a superglobal array holding information about the current request and the server environment handling it.
  • Common keys include REQUEST_METHOD, REQUEST_URI, HTTP_HOST, REMOTE_ADDR, and SCRIPT_NAME.
  • Client-supplied $_SERVER values (like HTTP headers) should never be trusted blindly for security-sensitive decisions.
Browser Support

$_SERVER has been a core PHP superglobal since PHP's earliest versions, though the exact set of available keys can vary slightly by web server software.

🔒

Chapter Quiz — Complete all 8 topics to unlock

0/8 topics done

Complete these topics first:

← Previous Lesson PHP $GLOBALS Next Lesson → PHP Arithmetic Operators

Login to run this code

C/C++/Java/PHP execution requires a free account. Your code is saved — you'll land right back in the editor after logging in.