What does $_SERVER on its own do?

Question

I have come across the following three lines of code:

$_SERVER;
$_ENV;
$_REQUEST;

To me it seems like these three lines of code do nothing. They don't cause any errors.

I know what these three global variables are, I just don't know what these three lines of code are doing. Can anyone enlighten me?

The whole file - in case it's relevant:

<?PHP
function register_global_array( $sg ) {
    Static $superGlobals    = array(
        'e' => '_ENV'       ,
        'g' => '_GET'       ,
        'p' => '_POST'      ,
        'c' => '_COOKIE'    ,
        'r' => '_REQUEST'   ,
        's' => '_SERVER'    ,
        'f' => '_FILES'
    );

    Global ${$superGlobals[$sg]};

    foreach( ${$superGlobals[$sg]} as $key => $val ) {
        $GLOBALS[$key]  = $val;
    }
}
function register_globals( $order = 'gpc' ) {
    $_SERVER;       //See Note Below
    $_ENV;
    $_REQUEST;

    $order  = str_split( strtolower( $order ) );
    array_map( 'register_global_array' , $order );
}
register_globals('GPCFRES');
?>

And no, there isn't any note below.

They clearly do something because if I remove them, then the foreach line errors.

Those variables won't be registred unless they are used. If you try to use `$_GLOBALS['_SERVER']` before using `$_SERVER`, it will return `null`. — Ismael Miguel, Apr 13 '15 at 13:33
I've now added `print $_GLOBALS['_SERVER'];` before and after the `register_globals` call and it is undefined both times, so not sure what you are saying Ismael. — Graham, Apr 13 '15 at 13:43
Also tried `print $GLOBALS['_SERVER'];` before and after and that gives me a value both time — Graham, Apr 13 '15 at 14:00
@Graham: I think they initialize the variables. Some php engines might wait to postpone the creation of the variables to the point where they are needed. But perhaps that mechanism doesn't work using `${$SuperGlobals...}`. — Willem Van Onsem, Apr 13 '15 at 14:02
Sorry, it really is `$GLOBALS` and not `$_GLOBALS`. I can't find it now, but there was a comment somewhere on php.net explaining that sometimes the superglobals wouldn't be available for exporting/debugging/access over `$GLOBALS`. I can't find it now. — Ismael Miguel, Apr 13 '15 at 14:15
Is it worth noting that directly accessing superglobals is considered a bad practice? If you are using a framework, these will almost always be made available in a safer way for you. I know that doesn't help your question, but I feel it's an important point to make. Ref: http://phpmd.org/rules/controversial.html#superglobals — DanielM, Apr 13 '15 at 15:52
Side note: Tested PHP 5.5.9 and PHP 5.4.38 and both are happy using `print_r($GLOBALS['_SERVER']);` as the first line of a script with no includes. — DanielM, Apr 13 '15 at 16:07

Carl McDade · Accepted Answer · 2015-04-14T09:50:03.330

I am not sure if your question is using the proper verb. $_SERVER is a variable. Variables are containers for values alone they "do" nothing . The $GLOBALS variable is the root of an array value in the variable. The $_SERVER variable and others match/map as keys in this array. Running a print_r or var_dump will give you more knowledge of how this is structured

<?php echo '<pre>'. print_r($GLOBALS,1) . '</pre>'; ?>

gives:

Array
(
[_GET] => Array
    (
    )

[_POST] => Array
    (
    )

[_COOKIE] => Array
    (
    )

[_FILES] => Array
    (
    )

[_ENV] => Array
    (
    )

[_REQUEST] => Array
    (
    )

[_SERVER] => Array
    (
        [HTTP_HOST] => fhqk.com
        [HTTP_USER_AGENT] => Mozilla/5.0 (Windows NT 6.1; WOW64; rv:37.0) Gecko/20100101 Firefox/37.0
        [HTTP_ACCEPT] => text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        [HTTP_ACCEPT_LANGUAGE] => en-US,en;q=0.5
        [HTTP_ACCEPT_ENCODING] => gzip, deflate
        [HTTP_CONNECTION] => keep-alive
        [HTTP_CACHE_CONTROL] => max-age=0
        [PATH] => /sbin:/usr/sbin:/bin:/usr/bin
        [SERVER_SIGNATURE] => Apache/2.2.15 (CentOS) Server at fhqk.com Port 80

        [SERVER_SOFTWARE] => Apache/2.2.15 (CentOS)
        [SERVER_NAME] => fhqk.com
        [SERVER_ADDR] => 144.76.244.51
        [SERVER_PORT] => 80
        [REMOTE_ADDR] => 77.12.152.125
        [DOCUMENT_ROOT] => /var/vhosts/fhqk.com/www
        [SERVER_ADMIN] => root@localhost
        [SCRIPT_FILENAME] => /var/vhosts/fhqk.com/www/informationtechnology/movico/index.php
        [REMOTE_PORT] => 16183
        [GATEWAY_INTERFACE] => CGI/1.1
        [SERVER_PROTOCOL] => HTTP/1.1
        [REQUEST_METHOD] => GET
        [QUERY_STRING] => 
        [REQUEST_URI] => /informationtechnology/movico/
        [SCRIPT_NAME] => /informationtechnology/movico/index.php
        [PHP_SELF] => /informationtechnology/movico/index.php
        [REQUEST_TIME_FLOAT] => 1428950219.959
        [REQUEST_TIME] => 1428950219
    )

   [GLOBALS] => Array
     *RECURSION*
    )

Update: I just read the code in your post and had a flash back to php version 3. Registering super globals was common back the day. It is not something that is done in modern PHP. I recommend removing this code and refactoring to fix any errors that occur as a result. Registering Super globals wether they be yours or otherwise can lead to some nasty security. flaws if not handled correctly. register_globals has been deprecated.

What does $_SERVER on its own do?

1 Answers1