PHP website domainname

Question

I've seen some posts like this which show that the current website domain is accessible from $_SERVER['HTTP_HOST'] and $_SERVER['SERVER_NAME']. The HTTP_HOST is an HTTP header and thus the user is free to change it. There is no reason to believe it's accurate. The SERVER_NAME doesn't change in my situation, because I use an domain alias that does change the domain but not the SERVER_NAME. What's best to do in this situation?

Answer 1

Although a user is free to change HTTP_HOST, they would hardly reach your site in this case.

Anyway, I see no problem in this ability to change. Okay, even if I set this header to some.bad.bad.words - whom it would harm?

Answer 2

You could trust on your host name. Try with:

$hostname = exec('echo $HOSTNAME');