un-escaped _server variable in settings.php - bad idea right? I recently started working for a new company hosting drupal sites that is using a switch statement within the settings.php for multiple environments. I am accustomed to using multi-site and am exploring the feasibility of having configurations like this.

What concerns me is the lack of any sanitation or escaping of the variable and using it in its raw form. Is this a terrible idea or is it fine if we start sanitizing the 'http_host' variable?

Code: 

    switch ($_SERVER['HTTP_HOST']) {

    //Live Settings
    case (preg_match('/^www\.domain\.com$/', $_SERVER['HTTP_HOST']) ? $_SERVER['HTTP_HOST'] : !$_SERVER ['HTTP_HOST']) :
    case (preg_match('/^web001\.domain\.domroot\.com$/', $_SERVER['HTTP_HOST']) ? $_SERVER['HTTP_HOST'] : !$_SERVER['HTTP_HOST']) :
    case (preg_match('/^web002\.domain\.domroot\.com$/', $_SERVER['HTTP_HOST']) ? $_SERVER['HTTP_HOST'] : !$_SERVER['HTTP_HOST']) :
    //Include file that contains sensitive db string
    include_once 'sites/default/settings.live.php';
    break;

    ...

     }
D7 ? No need to do this!


First, talking about what you are doing, if it's for a Drupal 7 site, you do not need to do this in the first place. 
Read the sites/example.sites.php for multisite settings. 


$_SERVER['HTTP_HOST'] is almost safe. 


See this great answer about how much secure $_SERVER variables are.


There is no point of sanitizing it either. 


From Drupal.org post Writing Secure code, 


  Whether you are writing a PHP snippet or an entire module, it is
  important to keep your code secure. Use check functions on output to
  prevent cross site scripting attacks
  
  No piece of user-submitted content should ever be placed as-is into
  HTML.


But you are not outputting anything or populating any variable so you do not need to sanitize any output here.