6

I have a public facing debug script that I would only like to run on certain dev boxes, I was hoping to do this programatically inside this script, by detecting the server ip or name-

So I have a question about the security of $_SERVER and $_SERVER['HTTP_HOST'] in particular.

From this: http://shiflett.org/blog/2006/mar/server-name-versus-http-host blog post I have gathered that this var is pretty insecure, and can't be trusted.

What is the best way to find out from php what box you are currently on?

I thought of using FILE , since that seems to be pretty secure, but I'm not sure I have enough info just from the file path.

I don't necessarily need the server name, even ip would be fine.

thanks in advance.

1
  • +1 for link to really interesting blog post.
    – Jacob
    Feb 17, 2011 at 1:58

4 Answers 4

3

The best way? It depends on the level of control you have on your environment. Here are some options:

  1. Set an environmental variable via the webserver to indicate the box.

    if (getenv('env_server') == 'production')
    

    This is nice, since there's no files that you need to worry about. Just the webserver configuration.

  2. Set a file in a "known" place on the server, and check that (one file for the entire server).

    require('/path/to/environment.php');
    

    That file should define a constant to determine the environment.

  3. Manually configure each application for the server. This is the easiest to do, since it doesn't require anything on the server side, but it's also the least convenient since you need to manually configure each install...

  4. External IP address used to get to the site:

    $_SERVER['SERVER_ADDR']

    This is nice since it requires no additional configuration on the server side. But it will require you to keep a map of all active IP addresses, and the servers they are bound to (especially since more than 1 IP can point to the same server)...

2

The best method is to explicitly define the machine by placing an environment config file on it and checking for it:

if (file_exists('environment.php')) {
    include 'environment.php';
}

This file could contain just the name of the machine you're on, or configuration settings like $debug = 0 or whatever else you want to customize for specific machines.

0

What is the best way to find out from php what box you are currently on?

$_SERVER["SERVER_NAME"] will usually be fine. The security problems Chris outlines need very, very specific circumstances to work.

$_SERVER["SERVER_ADDR"] would be an alternative, too.

Other than that, I would tend to go with __FILE__ if there is any chance of getting a hint from the path.

1
  • Can you talk about the 'specific circumstances' that the blog post needs to work? I briefly checked his examples out with curl (curl -H), and they seem to work exactly as advertised... no special tricks needed.
    – awongh
    Feb 17, 2011 at 3:28
0

You could use exec() to run a shell command.

echo exec('hostname');

This can get the IP address on OS X, may be platform specific.

echo exec('ifconfig | grep "inet " | grep -v 127.0.0.1 | cut -d\  -f2');

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.