PHP 7.0.6 Released

    Predefined Variables

    PHP provides a large number of predefined variables to all scripts. The variables represent everything from external variables to built-in environment variables, last error messages to last retrieved headers.

    See also the FAQ titled "How does register_globals affect me?"

    Table of Contents

    User Contributed Notes

    New York PHP
    10 years ago
    Warning: $_SERVER['PHP_SELF'] can include arbitrary user input. The documentation should be updated to reflect this.

    The request "http://example.com/info.php/attack%20here" will run /info.php, but in Apache $_SERVER['PHP_SELF'] will equal "/info.php/attack here". This is a feature, but it means that PHP_SELF must be treated as user input.

    The attack string could contain urlencoded HTML and JavaScript (cross-site scripting) or it could contain urlencoded linebreaks (HTTP response-splitting).

    The use of $_SERVER['SCRIPT_NAME'] is recommended instead.
    Gregory Boshoff
    11 years ago
    The Environment variable $ENV is useful for coding portable platform specific application constants.

    // Define a Windows or else Linux root directory path
    $_ENV['OS'] == 'Windows_NT' ? $path = 'L:\\www\\' : $path = ' /var/www/';

    define('PATH', $path);

    echo PATH;
    jameslporter at gmail dot com
    9 years ago
    Refer to CanonicalName if you are not getting the ServerName in the $_SERVER[SERVER_NAME] variable....This was a pain to figure out for me...now it works as expected by turning canonical naming on.

    http://www.apacheref.com/ref/http_core/UseCanonicalName.html
    autofei at gmail dot com
    5 years ago
    if you try to run php through command line, for example: php.exe c:\AppServ\www\cron_cache.php. You better avoid to use $_SERVER['DOCUMENT_ROOT'], because it will return nothing. Instead, you can use dirname(__FILE__). The reason to use command line running php is set it as Windows Scheduled Tasks. I did not test under Linux environment, but might be same.
    Ben XO
    10 years ago
    So you have an application in your web space, with a URL such as this:

    http://<host>/<installation_path>/

    and pages such as

    http://<host>/<installation_path>/subfolder1/subfolder2/page.php

    You have a file called config.php in <installation_path> which is include()d by all pages (in subfolders or not).

    How to work out <installation_path> without hard-coding it into a config file?

    <?php

    // this is config.php, and it is in <installation_path>
    // it is included by <installation_path>/page.php
    // it is included by <installation_path>/subfolder/page2.php
    // etc

    $_REAL_SCRIPT_DIR = realpath(dirname($_SERVER['SCRIPT_FILENAME'])); // filesystem path of this page's directory (page.php)
    $_REAL_BASE_DIR = realpath(dirname(__FILE__)); // filesystem path of this file's directory (config.php)
    $_MY_PATH_PART = substr( $_REAL_SCRIPT_DIR, strlen($_REAL_BASE_DIR)); // just the subfolder part between <installation_path> and the page

    $INSTALLATION_PATH = $_MY_PATH_PART
            ? substr( dirname($_SERVER['SCRIPT_NAME']), 0, -strlen($_MY_PATH_PART) )
        :     dirname($_SERVER['SCRIPT_NAME'])
    ;     // we subtract the subfolder part from the end of <installation_path>, leaving us with just <installation_path> :)

    ?>
    daniel at softel dot jp
    10 years ago
    Note that $php_errormsg may contain a newline character. This can be problematic if you are trying to output it with a JavaScript "alert()" for example.
    Gregory Boshoff
    10 years ago
    $_SERVER['QUERY_STRING']

    Does not contain XHTML 1.1 compliant ampersands i.e. &amp;

    So you will need to do something like this if you are to use $_SERVER['QUERY_STRING'] in URL's.

    //  XHTML 1.1 compliant ampersands
    $_SERVER['QUERY_STRING'] =
    str_replace(array('&amp;', '&'), array('&', '&amp;'),
    $_SERVER['QUERY_STRING']);
    david at grant dot org dot uk
    11 years ago
    $_SERVER['DOCUMENT_ROOT'] *is* supported by IIS, although only when running PHP as an ISAPI module.
    youdontmeanmuch [at] yahoo.com
    12 years ago
    Be carful when using $_SERVER['DOCUMENT_ROOT']; in your applications where you want to distribute them to other people with different server types. It isnt always supported by the webserver (IIS).
    Aardvark
    10 years ago
    $_GET may not handle query string parameter values which include escaped Unicode values resulting from applying the JavaScript "escape" function to a Unicode string.
    To handle this the query parameter value can be obtained  using a function such as:

    function getQueryParameter ($strParam) {
      $aParamList = explode('&', $_SERVER['QUERY_STRING']);
      $i = 0;
      while ($i < count($aParamList)) {
        $aParam = split('=', $aParamList[$i]);
        if ($strParam == $aParam[0]) {
          return $aParam[1];
        }
      }
      return "";
    }

    or by directly building an array or query string values and then processing the parameter string using a function such as the "unescape" function which can be found at http://www.kanolife.com/escape/2006/03/unicode-url-escapes-in-php.html (or http://www.kanolife.com/escape/ for related info).
    marcus at lastcraft dot com
    11 years ago
    The variable $php_errormsg is not populated if you have XDebug running.
    josh,endquote,com
    12 years ago
    Running PHP 4.3 under IIS 5 on Windows XP, there is no $_SERVER['REQUEST_URI'] variable. This seems to fix it:

    if(!isset($_SERVER['REQUEST_URI'])) {
        $_SERVER['REQUEST_URI'] = substr($_SERVER['argv'][0], strpos($_SERVER['argv'][0], ';') + 1);
    }
    drew dot griffiths at clare dot net
    10 years ago
    Re: You can take advantage of 404 error to an usable redirection using REQUEST_URI ...

    Whilst this is effective, a line in the .htaccess such as:

    RewriteEngine On
    RewriteRule ^profiles/([A-Za-z0-9-]+) showprofile.php?profile=$1 [L,NC,QSA]

    will throw the requested profile in a variable $profile to the showprofile.php page. 

    You can further enhance the url (e.g http://servername/profiles/Jerry/homeaddress/index.htm) and the second variable value homeaddress becomes available in $url_array[3] when used below $url_array=explode("/",$_SERVER['REQUEST_URI']);  

    Hope this helps - Works well for me

    Drew
    moochm@gmail
    8 years ago
    When using a php script like a remote function call, I find something like this useful for setting default parameters.

    <?php
    /**
    /* combine _GET _POST _COOKIE variables with provided default values
    /* defaults - associative array of default values
    /* overwrite - if true, write result to _REQUEST superglobal
    /* super_globals - array of super globals to fetch values from
    **/
    function get_params($defaults = null, $overwrite = false, $super_globals = array('_GET', '_POST', '_COOKIE'))
    {
            $ret = array();

            // fetch values from request
            foreach($super_globals as $sg)
            foreach(    $GLOBALS[$sg] as $k=>$v)
                    $ret[$k] = $v;

            // apply defaults for missing parameters
            if($defaults) foreach($defaults as $k=>$v)
            if(!isset(    $ret[$k]))
                    $ret[$k] = $v;

        if(    $overwrite)
                $_REQUEST = $ret;

        return     $ret;
    }

    // Example: page.php?style=modern

    $argv = get_params(array('id'=>42, 'style'=>'medieval'));

    // $argv['id'] = 42
    // $argv['style'] = 'modern'

    ?>
    niles AT atheos DOT net
    11 years ago
    If your having problems returning $_SERVER variables using apache, be sure you enable:

    ExtendedStatus On

    in your httpd.conf file.

    If it's off, then things like $_SERVER['HTTP_HOST'] won't be present.
    justin dot (nospam)george at gmail dot com
    10 years ago
    Note that it's a very, very bad idea to append to global variables in a loop, unless you really, really mean to do so in a global context. I just a while ago hung my server with a snippet of code like this:

    <?php
    $host      = $_SERVER['HTTP_HOST'];
    $uri  = rtrim($_SERVER['PHP_SELF'], "/\\");

      
    $GLOBALS['SITE_ROOT'] = "http://$host$uri";

    while (    $i < somenumber)
    readfile($GLOBALS['SITE_ROOT'] = $GLOBALS['SITE_ROOT'] . '/this/file.php');
    $i++
    }
    ?>

    While it is an entertaining and unusual method of creating very long URLs and breaking servers, it's a pretty awesomely bad idea

    (Especially considering that the script in question ran concurrently with others of it's type, so the value in $GLOBALS['SITE_ROOT'] was unknown.)
    dotpointer
    11 years ago
    Running Xitami in Windows 2000 and PHP 4.3.7, nor PHP_SELF or SCRIPT_FILENAME is not availiable. Trying SCRIPT_NAME instead. Here is a function that returns the filename of a script without slashes. Good for use in HTML FORM ACTION=""-arguments...

    function getThisFile() {

    /* try to use PHP_SELF first... */
    if (!empty($_SERVER['PHP_SELF'])) {
      $strScript = $_SERVER['PHP_SELF'];
    /* otherwise, try SCRIPT_NAME */
    } else if (!empty($_SERVER['SCRIPT_NAME'])) {
      $strScript = @$_SERVER['SCRIPT_NAME'];
    /* last resort - quit out and return nothing */
    } else {
      return null;
    }

    /* fint last frontslash in filename */
    $intLastSlash = strrpos($strScript, "/");

    /* check if last backslash is more far away in filename */
    if (strrpos($strScript, "\\")>$intLastSlash) {
      /* if so, use the backslash position instead */
      $intLastSlash = strrpos($strScript, "\\");
    }

    /* cut out from the last slash and to the end of the filename */
    return substr($strScript, $intLastSlash+1, strlen($strScript));
    }

    Tested on PHP 4.3.7/Win32 and PHP 5.0.3/Linux.
    You may add more filepaths to the first if-section
    to get more chances to catch up the filename if you can.
    ca2
    1 year ago
    Note $this and anything like it should be listed on this page.
    dusted at dusted dot dk
    5 years ago
    I use HTTP_X_FORWARDED_FOR because my webserver is behind a reverse proxy.
    This can be made secure:
    Configure the reverse proxy to block this field, and override it correctly.
    Configure the apache server to only accept incoming connections from the reverse proxy.
    spamtrap at scottydm dot com
    8 years ago
    I was a little frustrated by the fact that some of the _SERVER variables didn't seem to exist, so I did a bit of Googling and found the answer: many of these variables are supplied by the web server and not all web servers supply the same set of variables.

    I found a comparison between Apache v1.3.29 and IIS v5.1 on this page: http://koivi.com/apache-iis-php-server-array.php Useful for those of us doing cross-platform development.

    While running experiments with different browsers I noticed some of the HTTP_* variables come and go depending on the browser used, or in the case of Opera by diddling the "user mode" (the widget that lets you look at a page as text only, etc.). For example: in IE and Opera HTTP_KEEP_ALIVE was missing, but was present in Firefox and Mozilla, and when I fiddled with Opera's "user mode" I got somethings called HTTP_TE and HTTP_CACHE_CONTROL.

    So, what you get is dependent on the web server AND the browser.

    I did see one IIS supplied variable not on that list: REQUEST_TIME, which seems to be in Unix timestamp format.

    While researching this I discovered there are plenty of people who have their phpinfo() page visible and indexed on a few search engines. For those who want to dig a bit deeper than that nice web page comparing Apache to IIS, looking at other peoples' phpinfo() pages could be useful. You get the version of PHP plus OS and web server they use, along with all the _SERVER variables. I found the highest percent of signal-to-noise by searching for "phpinfo()" (with the quotes) on Dogpile: http://www.dogpile.com/
    Nicolae Namolovan
    8 years ago
    SECURITY RISK !

    Never ever trust the values that comes from $_SERVER.

    HTTP_X_FORWARDED, HTTP_X_FORWARDED_FOR, HTTP_FORWARDED_FOR, HTTP_FORWARDED, etc.. can be spoofed !

    To get the ip of user, use only $_SERVER['REMOTE_ADDR'], otherwise the 'ip' of user can be easily changed by sending a HTTP_X_* header, so user can escape a ban or spoof a trusted ip.

    Of course this is well know, but I don't see it mentioned in these notes..

    If you use the ip only for tracking (not for any security features like banning or allow access to something by ip), you can also use HTTP_X_FORWARDED to get user's ip what are behind proxy.
    Anonymous
    10 years ago
    I was unable to convince my hosting company to change their installation of PHP and therefore had to find my own way to computer $_SERVER["DOCUMENT_ROOT"].  I eventually settled on the following, which is a combination of earlier notes (with some typos corrected):

    <?php
    if ( ! isset($_SERVER['DOCUMENT_ROOT'] ) )
          $_SERVER['DOCUMENT_ROOT'] = str_replace( '\\', '/', substr(
            $_SERVER['SCRIPT_FILENAME'], 0, 0-strlen($_SERVER['PHP_SELF']) ) );
    ?>
    chris at vault5 dot com
    10 years ago
    Since $_SERVER['DOCUMENT_ROOT'] is not always present, the following will provide it where $_SERVER dosen't.

    <?php
    function resolveDocumentRoot() {
            $current_script = dirname($_SERVER['SCRIPT_NAME']);
            $current_path   = dirname($_SERVER['SCRIPT_FILENAME']);
       
            /* work out how many folders we are away from document_root
           by working out how many folders deep we are from the url.
           this isn't fool proof */
            $adjust = explode("/", $current_script);
            $adjust = count($adjust)-1;
       
            /* move up the path with ../ */
            $traverse = str_repeat("../", $adjust);
            $adjusted_path = sprintf("%s/%s", $current_path, $traverse);

            /* real path expands the ../'s to the correct folder names */
            return realpath($adjusted_path);   
    }

    ?>

    It counts the number of folders down the path we are in the URL, then moves that number of folders up the current path... end result should be the document root :)

    It wont work with virtual folders or in any situation where the folder in the URL dosen't map to a real folder on the disk (like when using rewrites).
    mfyahya at gmail dot com
    10 years ago
    If you use Apache's redirection features for custom error pages or whatever, the following Apache's REDIRECT variables are also available in $_SERVER:
    $_SERVER['REDIRECT_UNIQUE_ID]'
    $_SERVER['REDIRECT_SCRIPT_URL]'
    $_SERVER['REDIRECT_SCRIPT_URI]'
    $_SERVER['REDIRECT_SITE_ROOT]'
    $_SERVER['REDIRECT_SITE_HTMLROOT]'
    $_SERVER['REDIRECT_SITE_CGIROOT]'
    $_SERVER['REDIRECT_STATUS]'
    $_SERVER['REDIRECT_QUERY_STRING]'
    $_SERVER['REDIRECT_URL]'

    I'm not sure if this is a complete list though
    mrnopersonality at yahoo dot com
    11 years ago
    Nothing about the message-body ...

    You can get cookies, session variables, headers, the request-uri , the request method, etc but not the message body. You may want it sometimes when your page is to be requested with the POST method.

    Maybe they should have mentioned $HTTP_RAW_POST_DATA or php://stdin
    danvasile at pentest dot ro
    9 years ago
    If you have problems with $_SERVER['HTTPS'], especially if it returns no values at all you should check the results of phpinfo(). It might not be listed at all.
    Here is a solution to check and change, if necessary, to ssl/https that will work in all cases:

    <?php
    if ($_SERVER['SERVER_PORT']!=443) {
    $sslport=443; //whatever your ssl port is
    $url = "https://". $_SERVER['SERVER_NAME'] . ":" . $sslport . $_SERVER['REQUEST_URI'];
    header("Location: $url");
    }
    ?>

    Of course, this should be done before any html tag or php echo/print.
    php-net dot ucn dot extranet dot sys at dark-chiaki dot net
    8 years ago
    In addition to mfyahya at gmail dot com (2007-06-07 03:33):

    If You are working with the Apache module mod_rewrite and want to set some environment vars, the Apache manual says this vars could be accessed in CGI using $ENV{VAR}. In PHP You might want to write $_ENV['VAR'] to get the value of VAR, but You have to access if via $_SERVER, and in some different ways:

    1. Example: .htaccess and example.php

    RewriteEngine on
    RewriteRule ^?var1=([^;]*);var2=([^;]*)$ \
    - [E=VAR1:$1,E=VAR2:$2]

    <?php echo($_SERVER['VAR1']."\r\n"
                  .$_SERVER['VAR2']); ?>

    2. Example: .htaccess and index.php

    RewriteEngine on
    RewriteRule ^index\.php$ - [L]
    RewriteRule ?var1=([^;]*);var2=([^;]*)$ \
    index.php [E=VAR1:$1,E=VAR2:$2]

    <?php echo($_SERVER['REDIRECT_VAR1']."\r\n"
                  .$_SERVER['REDIRECT_VAR2']); ?>

    Note: If any RewriteRule matches, an internal redirect than restarts (after the last defined rule, or immediately after the matched rule having a L-flag) checking the entire rule set again. For an internal redirect every defined VAR gets an 'REDIRECT_' prefix, i.e. VAR1 will be REDIRECT_VAR1, VAR2 will be REDIRECT_VAR2.

    Of course, You can (additionally) redefine the original VAR:

    RewriteEngine on
    RewriteRule ^index\.php$ \
    - [E=VAR1:%{REDIRECT_VAR1},E=VAR2:%{REDIRECT_VAR2},L]
    RewriteRule ?var1=([^;]*);var2=([^;]*)$ \
    index.php [E=VAR1:$1,E=VAR2:$2]

    With this, You will have $_SERVER['REDIRECT_VAR*'] -and- $_SERVER['VAR*'].

    ***

    The given examples are only for explanation, in any case they are not intended to fit Your needs. The "\<CRLF><SP>" in the .htaccess examples are only for display purpose, they should not occur in a real .htaccess file. The argument separator ';' in links can also be '&', but this may cause some trouble with HTML/XHTML. See the following pages for more information about this issue:
    - http://www.w3.org/TR/html4/appendix/notes.html#h-B.2.2
    - http://www.w3.org/QA/2005/04/php-session
    todd dot kisov at yahoo dot com
    10 years ago
    To convert query string parameter values ($_GET, $_REQUEST), which include escaped Unicode values resulting from applying the JavaScript "escape" function to a Unicode string (%uNNNN%uNNNN%uNNNN) fast and simple is to use PECL JSON extension:

    function JavaScript_Unicode_URL_2_Str($js_uni_str) {
            $res = preg_replace('/%u([[:alnum:]]{4})/', '\\u\1', $js_uni_str);
            $res = str_replace('"', '\"', $res); // if in str "
            $res = json_decode('["'.$res.'"]'); // JavaScrip array with string element
            $res = $res[0];
            $res = iconv('UTF-8', ini_get('default_charset'), $res);
            return $res;
        }
    andy dot gajetzki at gmail dot com
    10 years ago
    I wanted to be able to embed a variable in the path. This is useful when, for example, images are rendered on the fly and you would like them to have different urls.

    Here is an illustration:

    www.somesite.com/image.php/IMAGETEXTHERE

    This would return an image with the text after "image.php/" contained in it.

    I could not recall the name of this feature, so I made a work-around in PHP...

    <?       
           
    function getPathVariables() {
            $sPathPS = $_SERVER[PHP_SELF];
            $sPathFS = __FILE__;

            $aPathPS = array_reverse(explode("/", $sPathPS));
            $aPathFS = array_reverse(explode("/", $sPathFS));

            $aImageArgs = array();
            $x = 0;

            while ( $aPathPS[$x] != $aPathFS[$x] && $aPathPS[$x] != $aPathFS[0] ) {
                    array_unshift($aImageArgs, $aPathPS[$x])        ;
                    $x++;
            }
            return $aImageArgs;

    }
    ?>

    This function will return an array containing each "/" delimited portion of the path after the script name itself.
    gajillion at gmail dot com
    7 years ago
    @SilentChris at gmail dot com - I'm seeing the same thing but I'm starting to believe the issue is not PHP but Apache.  It looks like Apache's rewrite module is double encoding strings with a '%' sign if they are followed by two or more other characters.  So

    %25 translates correctly to '%'
    %25b translates correctly to '%b'
    %25ba translates incorrectly to � which when itself is run through urlencode translates to '%BA'. 

    Further letters translate correctly.
    %25bac produces '�c', etc. 

    It only appears to happen on the first instance of %25 because further items are translated correctly.
    Joe Marty
    9 years ago
    I think it is very important to note that PHP will automatically replace dots ('.') AND spaces (' ') with underscores ('_') in any incoming POST or GET (or REQUEST) variables.

    This page notes the dot replacement, but not the space replacement:
    http://us2.php.net/manual/en/language.variables.external.php

    The reason is that '.' and ' ' are not valid characters to use in a variable name.  This is confusing to many people, because most people use the format $_POST['name'] to access these values.  In this case, the name is not used as a variable name but as an array index, in which those characters are valid.

    However, if the register_globals directive is set, these names must be used as variable names.  As of now, PHP converts the names for these variables before inserting them into the external variable arrays, unfortunately - rather than leaving them as they are for the arrays and changing the names only for the variables set by register_globals.

    If you want to use:
    <input name="title for page3.php" type="text">

    The value you will get in your POST array, for isntance would be:
    $_POST['title_for_page3_php']
    jsan
    8 years ago
    @White-Gandalf: one can control this behavior by setting:

    UseCanonicalName On|Off

    in their apache config (at least, on *ix platforms).

    On => $_SERVER['SERVER_NAME'] is the ServerName var from either the global server or virtual host, whichever wraps the PHP app closest.

    Off => Whatever was in the Host: header sent by the client.
    crescentfreshpot at yahoo dot com
    8 years ago
    In response to mathiasrav's getip() implementation on 28-Jul-2007, it should be noted that it:

    - assumes IPv4 addresses only
    - returns $_SERVER['REMOTE_ADDR'] for any value of $_SERVER['HTTP_CLIENT_IP'] that matches 127.0.*.*, 192.168.*.* or 10.0.*.*, which is not desirable if you actually WANT the value of HTTP_CLIENT_IP

    dlyaza's prior snippet has neither of these problems.
    xangelusx at hotmail dot com
    10 years ago
    A note about the QUERY_STRING variable when using IIS:

    I have found that IIS does not handle large query strings gracefully when passed from PHP. In addition to truncating them to around 1024 kb, I have seen IIS actually add data from other server variables to the end of the truncated data.

    This occurred on Windows 2000 server running IIS 5.0 and PHP 4.3.8.  The problem did not occur when handled by Apache, even on another Windows server.

    Note: I realize passing this much data is best accomplished using the POST method, which would avoid this problem all together. I'm merely detailing a problem that I came across.

    I have created a page that includes the (very long) query string that was used and some of the results that I saw while testing. It can be viewed at http://www.csb7.com/test/php_iis_qs_limit/. I didn't want to include it here as it would stretch the page out significantly.

    ~Chris Bloom
    root at mantoru dot de
    8 years ago
    Note that some headers will be checked for validity (by Apache, I suppose) before showing up in $_SERVER -- If-Modified-Since for example.

    <?php
    $lastmod     = gmdate('D, d M Y H:i:s', filemtime('somefile'));
    header("Last-Modified: $lastmod");
    ?>

    This WON'T work, "GMT" is missing. Internet Explorer auto-fixes this by adding GMT, while Firefox resends this data as-is. (So an If-Modified-Since-header is sent, but neither shows up in $_SERVER nor in apache_request_headers()). This would be correct:

    <?php
    $lastmod     = gmdate('D, d M Y H:i:s', filemtime('somefile')) . 'GMT';
    header("Last-Modified: $lastmod");
    ?>
    andres at andresj dot ath dot cx
    8 years ago
    To get the directory of the current script: (I think this is a little more resource-friendly, but then again with all the fast computers available, it does not matter so much...)
    <?
    // For the script that is running:
    $script_directory = substr($_SERVER['SCRIPT_FILENAME'], 0, strrpos($_SERVER['SCRIPT_FILENAME'], '/'));
    // If your script is included from another script:
    $included_directory = substr(__FILE__, 0, strrpos(__FILE__, '/'));
    echo $script_directory . '<br />';
    echo $included_directory . '<br />';
    ?>
    If you have a script that only includes the script written above in a directory called 'includer', and I access it from a web browser, this will be what I see:

    /path/to/includer/
    /path/to/included/
    Alexander Hars
    9 years ago
    If you want to use a form with multiple checkboxes (e.g. one per row) and assign the same name to each checkbox then the name needs to end with []. This tells PHP to put all checked values into an array variable.
    For example:
    <input type="checkbox" name="id[]" value="value_1">
    <input type="checkbox" name="id[]" value="value_2">
    ..
    <input type="checkbox" name="id[]" value="value_x">

    You can now retrieve all values by using:
       $values = $_POST['id'];

    If the name does not end with [], then only a single value will be available via the $_POST variable even if the user checks several checkboxes.
    webmaster at eclipse dot org
    10 years ago
    In response to tobias at net-clipping dot de

    It is not an Apache bug.  Please read http://httpd.apache.org/docs/2.1/mod/core.html#errordocument carefully (2.1 version here, 2.0 and 1.x is similar). 

    In short, if your ErrorDocument start with http:// Apache sends a redirect (302) to the error document, hence losing your original referer. If your ErrorDocument points to a relative path, 404 is maintained and so are your variables.

    From the Apache manual:

    "Note that when you specify an ErrorDocument  that points to a remote URL (ie. anything with a method such as http in front of it), Apache will send a redirect to the client to tell it where to find the document, even if the document ends up being on the same server. This has several implications, the most important being that the client will not receive the original error status code, but instead will receive a redirect status code. This in turn can confuse web robots and other clients which try to determine if a URL is valid using the status code. In addition, if you use a remote URL in an ErrorDocument 401, the client will not know to prompt the user for a password since it will not receive the 401 status code. Therefore, if you use an ErrorDocument 401 directive then it must refer to a local document."

    D.
    NeoSmart Technologies
    9 years ago
    The *only* way to make Request_URI work as a 100% Apache-Compliant server variable on IIS/Windows is to use an Isapi Filter - as documented at http://neosmart.net/blog/archives/291 . The various steps mentioned below *completely* fail when a rewrite engine is employed, since IIS will *never* return a non-existent path (i.e. the actual pretty-URI used) via its server variables.

    This also applies to accessing index.php via a folder.
    For instance, calls made to /folder/ will appear as /folder/index.php and not /folder/.

    The fix is to use the ISAPI filter provided at http://neosmart.net/blog/archives/291

    You don't have to modify any of the actual scripts once this filter is in place - it automatically intercepts calls to REQUEST_URI and replaces them with the actual user-entered path.
    nathan
    10 years ago
    Also on using IPs to look up country & city, note that what you get might not be entirely accurate.  If their ISP is based in a different city or province/state, the IPs may be owned by the head office, and used across several areas. 
    You also have rarer situations where they might be SSHed into another server, on the road, at work, at a friend's...  It's a nice idea, but as the example code shows, it should only be used to set defaults.
    White-Gandalf
    8 years ago
    'SERVER_NAME' does NOT necessarily refer to the name of a virtual host or any other things defined in the apache config.
    Instead it simply takes the value of the "Host:" entry of the HTTP-header sent by the client.
    At least with apache version 2.2.5 on Windows.
    tchamp
    10 years ago
    Be careful with HTTP_HOST behind a proxy server.   Use these instead.
    [HTTP_X_FORWARDED_FOR]
    [HTTP_X_FORWARDED_HOST]
    [HTTP_X_FORWARDED_SERVER]

    In my situation, I used [HTTP_X_FORWARDED_SERVER] in place of [HTTP_HOST] in order get the machine and hostname (www.myurl.com)
    Anonymous
    11 years ago
    Matt Johnson says that one should never urldecode() $_GET data. This is incorrect.

    If magic_quotes_gpc is turned off in php.ini, then you *do* need to urldecode() $_GET data.

    Having magic_quotes_gpc turned off is considered good practise.
    To Top