PHP $_SERVER

Every incoming web request carries a lot of information beyond just the submitted form data -- which URL was requested, what HTTP method was used, what the visitor's IP address is, which server is handling the request. PHP collects all of this into the $_SERVER superglobal array, giving scripts easy access to request and server environment details.

In this page:

Reading Basic Request Information
Identifying the Server and Host
Reading the Visitor's IP Address
Reading HTTP Headers via $_SERVER
Common $_SERVER Keys Reference

Reading Basic Request Information

$_SERVER["REQUEST_METHOD"] tells you whether the current request was a GET, POST, or another HTTP method, and $_SERVER["REQUEST_URI"] gives you the exact path (and query string) that was requested -- two of the most commonly used $_SERVER keys.

Note: Check $_SERVER["REQUEST_METHOD"] === "POST" at the top of a script that should only process form submissions, to avoid running that logic on a plain page visit.

Warning: $_SERVER["REQUEST_METHOD"] returns the method as an uppercase string like "GET" or "POST" -- comparing against a lowercase string will never match.

Example: Reading Basic Request Information

php

<?php
$_SERVER["REQUEST_METHOD"] = "GET";
$_SERVER["REQUEST_URI"] = "/products?id=5";
echo $_SERVER["REQUEST_METHOD"] . " " . $_SERVER["REQUEST_URI"];
?>

Identifying the Server and Host

$_SERVER["HTTP_HOST"] gives the domain name the visitor used to reach the site, and $_SERVER["SERVER_NAME"] gives the server's own configured name -- these are useful for building absolute URLs or detecting which domain (in a multi-domain setup) served the current request.

Note: Prefer $_SERVER["HTTP_HOST"] when building links meant to match exactly what the visitor typed, since it reflects the actual domain used in the request.

Warning: $_SERVER["HTTP_HOST"] is technically client-supplied and can be spoofed in unusual configurations -- avoid using it for security decisions without validation.

Example: Identifying the Server and Host

php

<?php
$_SERVER["HTTP_HOST"] = "example.com";
$_SERVER["SERVER_NAME"] = "example.com";
echo $_SERVER["HTTP_HOST"] . " / " . $_SERVER["SERVER_NAME"];
?>

Reading the Visitor's IP Address

$_SERVER["REMOTE_ADDR"] holds the IP address the server sees the request coming from -- useful for logging, rate limiting, or geolocation lookups, though it is not a perfectly reliable way to uniquely identify a specific visitor.

Note: Combine $_SERVER["REMOTE_ADDR"] with other signals (like a session ID or account login) if you need a more reliable way to track a specific visitor over time.

Warning: Behind a proxy or load balancer, REMOTE_ADDR often shows the proxy's IP rather than the visitor's real one -- HTTP_X_FORWARDED_FOR (also client-influenced and not fully trustworthy) is sometimes checked as a fallback, with care.

Example: Reading the Visitor's IP Address

php

<?php
$_SERVER["REMOTE_ADDR"] = "192.168.1.10";
echo "Request came from: " . $_SERVER["REMOTE_ADDR"];
?>

Reading HTTP Headers via $_SERVER

Many HTTP request headers are exposed through $_SERVER with an HTTP_ prefix and the header name uppercased with underscores -- $_SERVER["HTTP_USER_AGENT"] holds the browser's user-agent string, and $_SERVER["HTTP_REFERER"] holds the page the visitor came from, if any.

Note: Always run isset() before reading a header-based $_SERVER key, since not every request includes every header.

Warning: HTTP_USER_AGENT and HTTP_REFERER are both fully controlled by the client and can be set to anything (or omitted entirely) -- never treat them as trustworthy for security checks.

Example: Reading HTTP Headers via $_SERVER

php

<?php
$_SERVER["HTTP_USER_AGENT"] = "Mozilla/5.0";
$_SERVER["HTTP_REFERER"] = "https://google.com";
echo $_SERVER["HTTP_USER_AGENT"] . "\n" . $_SERVER["HTTP_REFERER"];
?>

Common $_SERVER Keys Reference

Beyond the keys already covered, a handful of others come up often: SCRIPT_NAME (the currently executing script's path), DOCUMENT_ROOT (the server's web root directory), SERVER_PROTOCOL (the HTTP version used), and QUERY_STRING (everything after the ? in the URL).

Note: When you are not sure a key exists on your server setup, print_r($_SERVER) once during development to see the full, actual list available in your environment.

Warning: The exact set of available $_SERVER keys can differ slightly between web servers (Apache, Nginx, built-in PHP server), so code relying on a less-common key should degrade gracefully if it is missing.

Example: Common $_SERVER Keys Reference

php

<?php
$_SERVER["SCRIPT_NAME"] = "/index.php";
$_SERVER["DOCUMENT_ROOT"] = "/var/www/html";
$_SERVER["QUERY_STRING"] = "id=5";
echo $_SERVER["SCRIPT_NAME"] . " " . $_SERVER["DOCUMENT_ROOT"] . " " . $_SERVER["QUERY_STRING"];
?>

Common Mistakes

Trusting $_SERVER values that originate from the client (like HTTP_USER_AGENT or HTTP_REFERER) as though they were guaranteed accurate -- browsers and clients can send whatever values they want for these headers.
Using $_SERVER["REMOTE_ADDR"] as a foolproof way to identify a unique visitor, when proxies, shared networks, and VPNs mean many visitors can share one IP.
Forgetting that not every $_SERVER key is guaranteed to exist on every server setup -- always check with isset() before relying on a less-common key.

Chapter Summary

$_SERVER is a superglobal array holding information about the current request and the server environment handling it.
Common keys include REQUEST_METHOD, REQUEST_URI, HTTP_HOST, REMOTE_ADDR, and SCRIPT_NAME.
Client-supplied $_SERVER values (like HTTP headers) should never be trusted blindly for security-sensitive decisions.

Browser Support

$_SERVER has been a core PHP superglobal since PHP's earliest versions, though the exact set of available keys can vary slightly by web server software.

🔒

Chapter Quiz — Complete all 8 topics to unlock

0/8 topics done

Complete these topics first:

← Previous Lesson PHP $GLOBALS Next Lesson → PHP Arithmetic Operators