un-escaped _server variable in settings.php - bad idea right?
D7 ? No need to do this!


First, talking about what you are doing, if it's for a Drupal 7 site, you do not need to do this in the first place. 
Read the sites/example.sites.php for multisite settings. 


$_SERVER['HTTP_HOST'] is almost safe. 


See this great answer about how much secure $_SERVER variables are.


There is no point of sanitizing it either. 


From Drupal.org post Writing Secure code, 


  Whether you are writing a PHP snippet or an entire module, it is
  important to keep your code secure. Use check functions on output to
  prevent cross site scripting attacks
  
  No piece of user-submitted content should ever be placed as-is into
  HTML.


But you are not outputting anything or populating any variable so you do not need to sanitize any output here.