Server variables: $_SERVER

$_SERVER is an array containing information such as headers, paths, and script locations. The entries in this array are created by the webserver. There is no guarantee that every webserver will provide any of these; servers may omit some, or provide others not listed here. That said, a large number of these variables are accounted for in the CGI 1.1 specification, so you should be able to expect those.

This is a 'superglobal', or automatic global, variable. This simply means that it is available in all scopes throughout a script. You don't need to do a global $_SERVER; to access it within functions or methods, as you do with $HTTP_SERVER_VARS.

$HTTP_SERVER_VARS contains the same initial information, but is not an autoglobal. (Note that $HTTP_SERVER_VARS and $_SERVER are different variables and that PHP handles them as such)

If the register_globals directive is set, then these variables will also be made available in the global scope of the script; i.e., separate from the $_SERVER and $HTTP_SERVER_VARS arrays. For related information, see the security chapter titled Using Register Globals. These individual globals are not autoglobals.

__________________
With,
J. Jeyaseelan
Everything Possible

$_SERVER['PHP_SELF']

The filename of the currently executing script, relative to the document root. For instance, $_SERVER['PHP_SELF'] in a script at the address http://example.com/test.php/foo.bar would be /test.php/foo.bar. The __FILE__ constant contains the full path and filename of the current (i.e. included) file.

__________________
With,
J. Jeyaseelan
Everything Possible

$_SERVER['SERVER_NAME']

The name of the server host under which the current script is executing. If the script is running on a virtual host, this will be the value defined for that virtual host.

__________________
With,
J. Jeyaseelan
Everything Possible

$_SERVER['REQUEST_METHOD']

Which request method was used to access the page; i.e. 'GET', 'HEAD', 'POST', 'PUT'.

PHP script is terminated after sending headers (it means after producing any output without output buffering) if the request method was HEAD.

__________________
With,
J. Jeyaseelan
Everything Possible

$_SERVER['QUERY_STRING']

The query string, if any, via which the page was accessed.

__________________
With,
J. Jeyaseelan
Everything Possible

$_SERVER['argv']

Array of arguments passed to the script. When the script is run on the command line, this gives C-style access to the command line parameters. When called via the GET method, this will contain the query string.

__________________
With,
J. Jeyaseelan
Everything Possible

$_SERVER['argc']

Contains the number of command line parameters passed to the script (if run on the command line).

__________________
With,
J. Jeyaseelan
Everything Possible

Hi,

HTTP is supported by all web browsers, and it does very well the job it was conceived for retrieving simple web content. Whenever you request a web page using your favorite web browser, the HTTP protocol is assumed.
So, for example,
when you type Mozilla.org - Home of the Mozilla Project in the location bar of Firefox, it will assume by default that you meant Mozilla.org - Home of the Mozilla Project.

__________________
Regards,
Senraj.A

Hi,

The standard document type of the Internet is HyperText Markup Language (HTML), and it is built of markup that web browsers understand, parse, and display. HTML is a language that describes documents' formatting and content, which is basically composed of static text and images. HTML wasn't designed for building complex web applications with interactive content or user-friendly interfaces. When you need to get to another HTML page via HTTP, you need to initiate a full page reload, and the HTML page you requested must exist at the mentioned location,as a static document, prior to the request. It's obvious that these restrictions don't really encourage building anything interesting. Nevertheless, HTTP and HTML are still a very successful pair that both web servers and web clients (browsers) understand. They are the foundation of the Internet as we know it today.A simple transaction when a user requests a web page from the Internet using the HTTP protocol.

Attached Files

A Simple HTTP Request.doc (29.0 KB, 1 views)

__________________
Regards,
Senraj.A

Hi,

Three points for you to keep in mind:
1. HTTP transactions always happen between a web client (the software making the request, such as a web browser) and a web server (the software responding to the request, such as Apache or IIS).when saying 'client' we refer to the web client, and when saying 'server' we refer to the web server.

2. The user is the person using the client.

3. Even if HTTP (and its secure version, HTTPS) is arguably the most important protocol used on the Internet, it is not the only one. Various kinds of web servers use different protocols to accomplish various tasks, usually unrelated to simple web browsing. The protocol we'll use most frequently in this book is HTTP, and when we say 'web request' we'll assume a request using HTTP protocol, unless other protocol will be mentioned explicitly.

__________________
Regards,
Senraj.A

Keeping in mind that we're passing the session identifier in a cookie, and this already requires that an attack be used to compromise this cookie (and likely all HTTP headers as well), we should pass this fingerprint as a URL variable. This must be in all URLs as if it were the session identifier, because both should be required in order for a session to be automatically continued (in addition to all checks passing).

__________________
With,
J. Jeyaseelan
Everything Possible