PHP Programming: Basics of Accessing the CGI Enviroment
Friday, April 08, 2005 - 07:37 PM

---

Getting Information About Web Browser Capabilities

I am not an advocate of serving different content based on which web browser the user is visiting. But sometimes it is unavoidable. Or you may want to collect information to tune your web pages to the particular capabilities of your site's audience. When a browser requests a page from a web server a number of environment variables are set. These are fairly standardized, although some web servers and software (such as PHP) may create or set new one not in a standard RFC paper. Software used to browse the web is called a "user agent" because it acts as an agent for the user, retrieving and displaying requested files. The browser is the client and the web server is, naturally, the server in this relationship.

<pre class="code"> $env["HTTP_USER_AGENT"] = getenv("HTTP_USER_AGENT"); $env["HTTP_ACCEPT"] = getenv("HTTP_ACCEPT"); Peeking Into the HTTP Environment

You may be curious about what environment variables are available. Here is a small script to display some of the most common and standard HTTP environment variables.

<pre class="code"> $env["REMOTE_ADDR"] = getenv("REMOTE_ADDR"); $env["SERVER_SOFTWARE"] = getenv("SERVER_SOFTWARE"); $env["SERVER_NAME"] = getenv("SERVER_NAME"); $env["GATEWAY_INTERFACE"] = getenv("GATEWAY_INTERFACE"); $env["SERVER_PROTOCOL"] = getenv("SERVER_PROTOCOL"); $env["SERVER_PORT"] = getenv("SERVER_PORT"); $env["REQUEST_METHOD"] = getenv("REQUEST_METHOD"); $env["PATH_INFO"] = getenv("PATH_INFO"); $env["PATH_TRANSLATED"] = getenv("PATH_TRANSLATED"); $env["DOCUMENT_ROOT"] = getenv("DOCUMENT_ROOT"); $env["SCRIPT_NAME"] = getenv("SCRIPT_NAME"); $env["QUERY_STRING"] = getenv("QUERY_STRING"); $env["REMOTE_HOST"] = getenv("REMOTE_HOST"); $env["AUTH_TYPE"] = getenv("AUTH_TYPE"); $env["REMOTE_USER"] = getenv("REMOTE_USER"); $env["REMOTE_IDENT"] = getenv("REMOTE_IDENT"); $env["CONTENT_TYPE"] = getenv("CONTENT_TYPE"); $env["CONTENT_LENGTH"] = getenv("CONTENT_LENGTH"); $env["HTTP_ACCEPT"] = getenv("HTTP_ACCEPT"); $env["HTTP_HOST"] = getenv("HTTP_HOST"); $env["HTTP_USER_AGENT"] = getenv("HTTP_USER_AGENT"); $env["HTTP_REFERER"] = getenv("HTTP_REFERER"); $env["HTTP_REFERRER"] = getenv("HTTP_REFFERER"); print "<table border=1 cellspacing=0 cellpadding=2>"; print "<caption>Environment Variables</caption>"; while ( list( $key, $val ) = each( $env ) ) { print "<tr><td bgcolor=#CCCCCC ><b>$key</b></td><td bgcolor=#EEEEEE><i>$val</i></td></tr>"; } print "</table>"; }

Why do I use getenv() instead of looking into the GLOBALS array for these values? Because anyone can spoof those values in the globals array. We cannot trust these same values when they come from the GLOBALS array, but getenv() retrieves the values directly from the environment. Many of these values are important to maintaining security on the web, such as REMOTE_HOST (for access to user's IP address) or PATH_INFO (sometimes carrying crucial information to scripts).

You may notice a few strange things about environment variables. For historical reasons, both the misspelled REFERRER (the misspelled version) and REFERRER are available. Handling referring URLs can be tricky because some older web servers still use the misspelled version, so you should check for a value in both. Sometimes variables become obsolete. For example, the HTTP_FROM variable generally returns nothing in most modern browsers. Originally it was for returning the user's email address in order to make filling out forms easy, but was dropped for privacy and anti-spam reasons.

How Can I See All the CGI Variables?

When debugging, you may want to see all the variables posted by a form or associated with a link (variables and values coming in from the CGI environment). Sometimes there may be an extra variable you had not thought was being submitted or you might be lacking a needed variable. HTTP_POST VARS holds all the variables coming from an HTML form submission.

<pre class="code"> // Dump POST Variables if($HTTP_POST_VARS) { print "<table border=1 cellspacing=0 cellpadding=2>"; print "<caption>Values submitted via POST method</caption>"; while ( list( $key, $val ) = each( $HTTP_POST_VARS ) ) { print "<tr><td bgcolor=#CCCCCC><b>$key</b></td> <td bgcolor=#EEEEEE><i>$val</i></td></tr>"; } print "</table>"; }

To look at the variables coming from a scripted page that is activated by a link, check HTTP_GET_VARS.

<pre class="code"> // Dump GET Variables print "<table border=1 cellspacing=0 cellpadding=2>"; print "<caption>Values submitted via GET method</caption>"; while ( list( $key, $val ) = each( $HTTP_GET_VARS ) ) { print "<tr><td bgcolor=#CCCCCC><b>$key</b></td> <td bgcolor=#EEEEEE><i>$val</i></td></tr>"; } print "</table>";

Both HTTP_GET_VARS and HTTP_POST_VARS are variables introduced into the CGI environment by PHP itself (they are arrays created when a PHP page executes). These are not part of the standard environment if PHP were not running (as far as I know).

Note: Reprinted from: http://www.phphelp.com/article/39p4.php

---