$_SERVER

$_SERVER exposes request and server environment information such as REQUEST_METHOD and SCRIPT_NAME. Some entries are derived from client headers and must not be trusted for authorization or canonical URLs. Check that a key exists and use a configured trusted host when generating absolute links. The request method is useful for routing, but authorization remains a separate check. Further guidance Superglobal values come from the request or process environment and can be missing or have an unexpected type. Check the key and shape before use, validate it for the operation, and avoid printing secrets or trusting client-controlled headers. Prefer the specific input source over merged request data. Practice task: Create a fresh example for $_SERVER. Predict the result before running it, then change one input and explain why the result changes. Test a normal case and one boundary or invalid case where it applies. Compare your output with the example and note one rule you would use in a real project.