4.4.1 to 4.4.8 base_url php spark closes..

I forgot to mention that the above code is vulnerable because it does not validate the value of $_SERVER['HTTP_HOST'].
In a production environment, all user input should be validated.

Can you elborate on that? what would be a way to validate it. I thought that comes from the server end. If they change the domain name, it wouldn't load my site it would load a different site? It's not entered anywhere so I don't understand how this would be considered user input?