PHP $_SERVER vs $HTTP_SERVER_VARS

If you have ever found that your PHP code using $HTTP_SERVER_VARS suddenly stops working, this info could come in handy. In short, the solution to your problem is probably simply to replace $HTTP_SERVER_VARS with $_SERVER. Keep everything else the same and things should work again. All array indexes should be the same.

This weekend I regenerated the php.ini file that controls how Grinderschool's server interprets our PHP code. This adjustment was performed in order to enable some new server-side functionality that is required for upcoming features that we are adding. It was a very simple process to regenerate, in our host's cPanel. A side benefit is that the new version fits the current hardware model for our host, meaning we get a bigger share of resources now than we could be allotted when we generated the previous config file a few years ago. Access to more memory and more CPU cycles can only lead to better things for the site.

Shortly after the new config file was in place, we discovered major problems with the permissions functionality that controls which videos our users can see. The driver behind this code is a comparison between a user's IP Address and the IP address logged in our database for their session. Experimentation revealed that all users were being treated as anonymous, and thus were denied access to any video content.

Digging further led to uncovering the source of the problem: the IP Address being queried from the database was always an empty string. We were using $HTTP_SERVER_VARS['REMOTE_ADDR'] to access this information. And it was coming up blank. Obviously, something had changed when php.ini was regenerated.

I did not write the block of code in question, so the fact that I always use $_SERVER when referencing this set of variables had no bearing on the overall issue. Rather, we contracted it out during a time when I was far too busy to do all of the site's coding. We have tested it thoroughly since that time, but I never examined the code enough to notice this particular variable. So long as things worked, I probably never would have noticed. But when more things stopped working, I quickly zoned in on this difference in coding techniques. Testing showed that using $_SERVER let the rest of the code work properly. So I made the changes and got everything back up and running.

Then I decided to dig a bit further. Research revealed a few things. First, the major difference between $_SERVER and $HTTP_SERVER_VARS is that $_SERVER is a superglobal. Meaning that it will always be available to any script. That is not the case in $HTTP_SERVER_VARS. Still, both are supposed to have the same values, so long as $HTTP_SERVER_VARS is accessible and hasn't been overwritten by user code. So it is possible that my regeneration of php.ini resulted in a change in whether or not the server instantiated $HTTP_SERVER_VARS. The second difference is that $HTTP_SERVER_VARS has been deprecated. Which could easily lead modern configurations to remove it from the set of variables that are instantiated on the server. So, now the problem is solved and the reason for it is clear in my mind.