title: Prevent Host header attack
body: <p>I scanned my website whit Acunetix Web Vulnerability Scanner and I got Host Header attack vulnerability.</p>
  
  <p>In description says that I writed </p>
  
  <blockquote>
    <p>(_SERVER["HTTP_HOST"] in PHP</p>
  </blockquote>
  
  <p>but i didn't and i don't know how to fix this.</p>
  
  <p>Here is my header of affected file</p>
  
  <pre><code>&lt;?php
      include 'core/init.php';
  
      if($user-&gt;is_loggedin()){
          redirect('index.php');
          exit();
      }
  
      if($detect-&gt;isMobile()){
          redirect('http://m.website.com/prijava.php');
          exit();
      }
  
      if(isset($_POST['prijava'])){
          $post = filter_input_array(INPUT_POST, FILTER_SANITIZE_STRING);
          if(time() - $user-&gt;failTime($post['email']) &lt; 600 &amp;&amp; $user-&gt;failCount($post['email']) &gt;= 3){
              $err = '&lt;p style="color:red;"&gt;Račun vam je zaključan na 10 minuta.&lt;/p&gt;';
          }else{          
              if(empty($post['email']) || empty($post['password'])){
                  $err = '';
              }elseif($id = $user-&gt;prijava($post['email'], $post['password'])){
                  if($user-&gt;isActive($post['email'])){                    
                      $_SESSION['user'] = $id['id'];
                      $user-&gt;resetFail();
                      redirect('index.php');
                      exit();
                  }else{
                      $err = '&lt;p style="color:red;"&gt;Korisnički račun nije aktiviran.&lt;/p&gt;';    
                  }           
              }else{
                  if($user-&gt;checkMail($post['email'])){
                      if($user-&gt;storeFail($post['email'])){
                          $err = '&lt;p style="color:red;"&gt;Lozinka i email se ne poklapaju.&lt;/p&gt;';
                      }
                  }else{
                      $err = '&lt;p style="color:red;"&gt;Lozinka i email se ne poklapaju.&lt;/p&gt;';
                  }           
              }
          }       
      }
  ?&gt;
  </code></pre>
  
  <p>And html </p>
  
  <pre><code>&lt;head&gt;
      &lt;meta charset="UTF-8"&gt;
      &lt;title&gt;Prijava&lt;/title&gt;
      &lt;link rel="shortcut icon" href="images/favicon.png" type="image/png"&gt;
      &lt;link rel="stylesheet" type="text/css" href="css/sign.css?&lt;?php echo time(); ?&gt;"&gt;       
      &lt;script src="https://ajax.googleapis.com/ajax/libs/jquery/3.1.1/jquery.min.js"&gt;&lt;/script&gt;
  &lt;/head&gt;
  </code></pre>
  
  <p>Here is image of Vulnerability description:</p>
  
  <p><a href="https://i.stack.imgur.com/rd0IA.png" rel="noreferrer"><img src="https://i.stack.imgur.com/rd0IA.png" alt="enter image description here"></a></p>
  
  <p>To sum up, how can I protect my website, thank you.</p>