|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #25172 register_globals=on and $HTTP_HOST sometimes empty
Submitted: 2003-08-20 05:03 UTC Modified: 2004-01-28 14:22 UTC
Avg. Score:4.6 ± 0.7
Reproduced:7 of 7 (100.0%)
Same Version:7 (100.0%)
Same OS:7 (100.0%)
From: php at lansco dot de Assigned:
Status: Not a bug Package: Apache2 related
PHP Version: 4.3.3 OS: Linux
Private report: No CVE-ID:
 [2003-08-20 05:03 UTC] php at lansco dot de
Sometimes $HTTP_HOST is empty while $_SERVER["HTTP_HOST"] contains the expected value.

After a reload $HTTP_HOST mostly contains the expected value.

This error also occurs with PHP-4.3.2

Reproduce code:
print "1: ".$HTTP_HOST."\n";
print "2: ".$_SERVER["HTTP_HOST"]."\n";

Expected result:

Actual result:


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2003-08-21 03:21 UTC] php at lansco dot de
With the error also occurs :(
 [2003-08-21 08:18 UTC]
What are your variables_order and gpc_order settings?
(from phpinfo() output)
Which webserver? Apache? What version?

 [2003-08-21 08:25 UTC] php at lansco dot de
variables_order = EGPCS
gpc_order = GPC
Apache Version = Apache/2.0.47 (Unix) mod_ssl/2.0.47 OpenSSL/0.9.6c DAV/2 PHP/4.3.3RC5-dev
 [2003-08-21 08:29 UTC]
What was the configure line used to configure Apache?
(And PHP too)

 [2003-08-21 08:38 UTC] php at lansco dot de
"./configure" \
"--prefix=/usr/local/apache2" \
"--with-mpm=prefork" \
"--enable-modules=deflate expires include info rewrite ssl unique_id usertrack log_config logio rewrite vhost_alias so ext_filter dav headers speling"

'./configure' '--with-mysql=/usr/local/mysql' '--enable-ftp' '--with-gd' '--with-gd-dir=/usr/local' '--with-jpeg' '--with-jpeg-dir=/usr/local' '--with-apxs2=/usr/local/apache2/bin/apxs' '--with-gettext' '--with-mcrypt' '--with-imap' '--with-imap-ssl' '--with-ldap' '--with-zlib-dir=/usr/include' '--enable-xslt' '--with-xslt-sablot' '--enable-exif'
 [2003-08-21 18:11 UTC]
One more thing: Where do you set "register_globals" ?
(php.ini and/or httpd.conf and/or .htaccess ?)

And can you try with this script instead:

    echo '<pre>';
    echo '</pre>';

I can not reproduce this..

 [2003-08-22 01:49 UTC] php at lansco dot de
I've created a Directory with a few interesting files:

Please try

as often as necessary to reproduce the error.

"register_globals" is only set in the php.ini
 [2003-08-22 03:52 UTC] php at lansco dot de
I can reproduce the error with
- 4.3.2
- 4.3.3-rc4
- 4.3.3-rc5-dev

I cannot reproduce the error with
- 4.3.1

I run all the test-series on the same machine (

Use this command line to test it on my server:

  watch -n 1 "wget -q -O xxx;cat xxx>>zzz;tail -n 30 zzz"

After a few minutes you can see the errors in the zzz-file.
 [2003-08-24 22:57 UTC]
Your test site shows the correct output all the time..
Have you checked phpinfo() output when this happens?
(add it to your test script)
What is in section "Apache Environment" for HTTP_HOST then?
(be sure the script gives the error about $HTTP_HOST being undefined)
What is register_globals setting set to at that time? (phpinfo(), both values)

 [2003-08-25 05:08 UTC] php at lansco dot de
I have tested it right now with this command line:

# watch -n 1 "wget -q -O xxx;cat xxx>>zzz;tail -n 30 zzz"

For about 10 minutes no error occured. After that time in nearly every request I have had this error for about 30 times.

I added the line

  if(!isset($HTTP_HOST)) phpinfo();

to and there is a really surprising phenomenon:
In the phpinfo()-output HTTP_HOST is correctly set to!!!

register_globals is only set by the php.ini-file.

Please try again and test it for about 20 to 30 minutes.
 [2003-08-25 22:24 UTC]
Yes, it took about 30 minutes until I got the same result.
This is what I found:
register_globals Off On

Something caused this..are you ABSOLUTELY sure you don't use ANY "php_value" or "php_admin_value" or "php_flag" or "php_admin_flag" directives in httpd.conf / .htaccess files?
(In ANY virtual host you might have there)

 [2003-08-26 06:16 UTC] php at lansco dot de
I've found one (among thousands) .htaccess-File that contains "php_flag register_globals off".

When I access the site that has this entry simultaneous with my test page the error occurs. Elsewise not.

After I have disabled the .htaccess-entry the error doesn't occur any more.

I have tested again various versions of PHP while accessing the site with .htaccess-entry:

PHP-4.3.1: no errors
PHP-4.3.2: errors
PHP-4.3.3: errors

Why does it properly work with PHP-4.3.1 and not with later versions?
 [2003-10-04 00:49 UTC]
See bug #25753 (placeholder for all these reports about leaking php ini settings)

 [2004-01-28 14:22 UTC]
This should now be fixed in CVS. Fix scheduled for PHP 4.3.5.

 [2004-06-07 16:41 UTC] david at 4dhosting dot com
I can report experiencing this problem under IIS6 and PHP 4.3.7.

It occurs when 'register_globals' is off.
PHP Copyright © 2001-2015 The PHP Group
All rights reserved.
Last updated: Fri Nov 27 08:01:34 2015 UTC