title: PHP $_SERVER['HTTP_HOST'] vs. $_SERVER['SERVER_NAME'], am I understanding the man pages correctly?
body: <p>I did a lot of searching and also read the PHP <a href="http://php.net/reserved.variables.server" rel="noreferrer">$_SERVER docs</a>. Do I have this right regarding which to use for my PHP scripts for simple link definitions used throughout my site?</p>
  
  <p><code>$_SERVER['SERVER_NAME']</code> is based on your web server's config file (Apache2 in my case), and varies depending on a few directives: (1) VirtualHost, (2) ServerName, (3) UseCanonicalName, etc.</p>
  
  <p><code>$_SERVER['HTTP_HOST']</code> is based on the request from the client.</p>
  
  <p>Therefore, it would seem to me that the proper one to use in order to make my scripts as compatible as possible would be <code>$_SERVER['HTTP_HOST']</code>. Is this assumption correct?</p>
  
  <p><strong>Followup comments:</strong></p>
  
  <p>I guess I got a little paranoid after reading this article and noting that some folks said "they wouldn't trust any of the <code>$_SERVER</code> vars":</p>
  
  <ul>
  <li><p><a href="http://markjaquith.wordpress.com/2009/09/21/php-server-vars-not-safe-in-forms-or-links/" rel="noreferrer">http://markjaquith.wordpress.com/2009/09/21/php-server-vars-not-safe-in-forms-or-links/</a></p></li>
  <li><p><a href="http://php.net/manual/en/reserved.variables.server.php#89567" rel="noreferrer">http://php.net/manual/en/reserved.variables.server.php#89567</a> (comment: Vladimir Kornea 14-Mar-2009 01:06)</p></li>
  </ul>
  
  <p>Apparently the discussion is mainly about <code>$_SERVER['PHP_SELF']</code> and why you shouldn't use it in the form action attribute without proper escaping to prevent XSS attacks.</p>
  
  <p>My conclusion about my original question above is that it is "safe" to use <code>$_SERVER['HTTP_HOST']</code> for all links on a site without having to worry about XSS attacks, even when used in forms.</p>
  
  <p>Please correct me if I'm wrong.</p>