PHP $_SERVER

The $_SERVER superglobal is an associative array that provides information about the server environment, HTTP requests, the current script, and the client. It helps PHP applications access request and server details.

• Server Information: Retrieves the server name, protocol, and port.
• Request Information: Accesses the request method, URI, and query string.
• Script Information: Retrieves the current script's name and filesystem path.
• Client Information: Provides details such as the client IP address and browser information, when available.

Accesses Server and Request Information

The $_SERVER array contains predefined entries populated by the web server and PHP runtime. Available entries depend on the server configuration and request.

Syntax:

$_SERVER['key'];

Common entries include:

Displays Server Details

The following example displays the server name, request method, and current script path.

Example:

<?php
echo "Server Name: " . ($_SERVER['SERVER_NAME'] ?? 'Unavailable') . "\n";
echo "Request Method: " . ($_SERVER['REQUEST_METHOD'] ?? 'Unavailable') . "\n";
echo "Script Name: " . ($_SERVER['SCRIPT_NAME'] ?? 'Unavailable');
?>

Output:

Server Name: localhost
Request Method: GET
Script Name: /index.php

Note: The output depends on the server configuration and how the page is accessed.

Checks the HTTP Request Method

The REQUEST_METHOD entry identifies the HTTP method used for the current request. It is commonly used to handle form submissions.

Example:

<?php
if (($_SERVER['REQUEST_METHOD'] ?? '') === 'POST') {
    echo "Form submitted using POST.";
} else {
    echo "Request received using another method.";
}
?>

This condition allows the application to process a form when the request method is POST.

Retrieves the Requested URI

The REQUEST_URI entry provides the URI requested by the client, generally including the query string.

Example:

<?php
echo "Requested URI: " . htmlspecialchars(
    $_SERVER['REQUEST_URI'] ?? '',
    ENT_QUOTES,
    'UTF-8'
);
?>

If the requested URL is http://localhost/index.php?id=10, the output may be:

Requested URI: /index.php?id=10

Use htmlspecialchars() when displaying request data in HTML to help prevent cross-site scripting (XSS).

Reads Query String Information

The QUERY_STRING entry contains the query string without the leading question mark.

For example, if the requested URL is http://localhost/index.php?name=Alex&age=22, the query string is:

name=Alex&age=22

Example:

<?php
echo htmlspecialchars(
    $_SERVER['QUERY_STRING'] ?? '',
    ENT_QUOTES,
    'UTF-8'
);
?>

To access individual query parameters, use the $_GET superglobal.

Retrieves Client Information

PHP can access client-related information through entries such as REMOTE_ADDR and HTTP_USER_AGENT.

Example:

<?php
echo "Client IP: " . htmlspecialchars(
    $_SERVER['REMOTE_ADDR'] ?? 'Unavailable',
    ENT_QUOTES,
    'UTF-8'
) . "<br>";

echo "Browser Information: " . htmlspecialchars(
    $_SERVER['HTTP_USER_AGENT'] ?? 'Unavailable',
    ENT_QUOTES,
    'UTF-8'
);
?>

• REMOTE_ADDR usually identifies the connecting client or proxy.
• HTTP_USER_AGENT contains a client-provided string that may describe the browser and operating system.
• These values may be unavailable or unreliable and should not be used alone for authentication or security decisions.

Checks Whether Server Entries Exist

Not every $_SERVER entry is available in every environment. Accessing a missing entry may produce an undefined array key warning.

The null coalescing operator (??) provides a fallback value.

Example:

<?php
$serverName = $_SERVER['SERVER_NAME'] ?? 'Unavailable';

echo "Server Name: " . htmlspecialchars(
    $serverName,
    ENT_QUOTES,
    'UTF-8'
);
?>

If SERVER_NAME is unavailable, the variable receives the value 'Unavailable'.

Server Variables for Request Handling

The $_SERVER array supports several common tasks:

• Form Processing: Checking REQUEST_METHOD before processing submitted data.
• URL Handling: Reading REQUEST_URI and QUERY_STRING.
• Script Identification: Accessing SCRIPT_NAME and SCRIPT_FILENAME.
• Request Logging: Recording details such as the request URI and client IP address.
• HTTPS Detection: Checking the server-provided HTTPS entry.

Note: Do not automatically trust client-controlled headers such as HTTP_HOST and HTTP_USER_AGENT. When an application runs behind a reverse proxy, its configuration affects how client IP addresses and HTTPS status are reported.