I know this is an old post, but doing a quick search on Google for "PHP $_SERVER security" came up with this post and I could not believe what I am seeing.
You should encode and check all inputs regardless of how much you think it is safe. For instance, the HTTP_HOST server variable is read from the headers of the request sent by the client. The "client" can be anything...not just browsers...for instance a PERL/python script someone wrote specifically to fuzz these headers.
From PHP documentation (again)...
'HTTP_HOST'
Contents of the Host: header from the current request, if there is one.
There is almost always a HTTP_HOST within the client request. This is not the only variable, Apache and PHP do not sanitize/encode these variables for you. You should encode and check ALWAYS and for ALL inputs including those "generated by the server."
<?php
$server = array();
foreach($_SERVER as $k => $v)
$server[urlencode($k)] = urlencode($v);
if(!preg_match("...", "...", $server["X"]))
exit;
?>
Remember, never assume that the inputs into your applications are safe. It is not worth being lazy about -- just encode and check everything regardless of what others think.