我可以信任 $_SERVER['SERVER_NAME'] 变量的内容吗？
我使用通配符子域为每个用户提供一个页面 username.domain.com。
用户名本身在注册时经过适当的清理。
为了简化此问题的目的，假设我有一个针对所有请求运行的 PHP 脚本。它使用...获取域组件
$domain_components = explode( '.', $_SERVER['SERVER_NAME'] );
，然后弹出 tld、主域和子域。
问题是，我是否需要将 $_SERVER['SERVER_NAME'] 变量的内容（特别是域组件）视为潜在敌对内容？直觉上，我认为不会，因为在到达我的代码之前，PHP 和 Apache 必须做得尽可能好（并且 这个答案似乎证实了这一点，因为该变量受服务器控制），但我想确保我没有忽略任何内容。
您是否知道通过 $_SERVER['SERVER_NAME'] 进行的任何已知攻击？
（我使用的是 PHP 5.3.9 和 Apache 2.2.3。）
I am using wildcard subdomains to give each of our users a page username.domain.com.
The usernames themselves are properly sanitized on signup.
To simplify things for the purposes of this question, assume I have a single PHP script that runs for all requests. It gets the domain components using...
$domain_components = explode( '.', $_SERVER['SERVER_NAME'] );
... and then pops off the tld, the primary domain and the subdomain.
The question is, do I need to treat the contents of the $_SERVER['SERVER_NAME'] variable, and in particular the domain components, as potentially hostile? Intuitively, I would think not since PHP and Apache must be doing as good a job as I could do before this ever reaches my code (and this answer seems to confirm it since the variable is under server control), but I would like to be sure that I'm not overlooking anything.
Do you know of any known attacks via $_SERVER['SERVER_NAME']?
(I'm using PHP 5.3.9 and Apache 2.2.3.)
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
http://shiflett.org/blog/2006/mar/server -name-versus-http-host
似乎存在一些风险，尽管该帖子很旧，但还是有一些提示。在查询中使用该变量（已清理/转义！）来查找正确的用户，如果可行，则接受它，这可能并没有错。在那之后，您不再需要它，因此只需使用您的内部数据。
http://shiflett.org/blog/2006/mar/server-name-versus-http-host
There seem to be some risks, there are some hints in that post although it is old. It might not be wrong to just use that variable (sanitized/escaped!) in a query to find the right user and if that works accept it. After that point you don't need it anymore so just use only your internal data.
我的理解是
$_SERVER变量是由服务器构造的 - 因此外部浏览器不能影响其内容，除非您的服务器受到损害。如果是这种情况，那么 $_SERVER 的内容是您最不用担心的。编辑
我打算添加除了那些采用
$_SERVER['HTTP...]形式的内容。My understanding is that the
$_SERVERvariables are constructed by the server - and therefore the external browsers cannot affect its contents unless your server is compromised. If that is the case, the contents of $_SERVER is the least of your worries.EDIT
I was meant to add except those that take the form
$_SERVER['HTTP...].您可以通过以下方式信任它设置的
SERVER_NAME：You can trust
SERVER_NAMEit sets by: