next »

[general vegitable]

So I am working on a project, which is secure, so if the user uses a proxy it will capture the true IP from it. this script should detect it from proxies and shared internet connections (No Idea what they are but hey!) so here is the basic script, tidies into a php function:

Code:

<?php
function ip()
{
if (!empty($_SERVER['HTTP_CLIENT_IP']))
{
   //shared internet
   ip=$_SERVER['HTTP_CLIENT_IP'];
}
elseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR']))
{
  //proxy
  $ip=$_SERVER['HTTP_X_FORWARDED_FOR'];
}
else
{
   //no proxy?
   $ip=$_SERVER['REMOTE_ADDR'];
}
return $ip;
}
?>

[Piotr GRD]

Be aware of what contain HTTP_X_FORWARDED_FOR if the request is going trough several proxies - all the previous IPs (except the last proxy used which is in REMOTE_ADDR) separated by commas:

http://www.www.www.www.grd.110mb.com/_test_/
(four times trough internal 110mb proxy)

[Hacker Fred]

Also be aware that each of these headers are optionally sent by proxies.  Depending on who's running the server, different http-headers representing the person's ip address may be sent (if any at all).  These headers can also be spoofed (this means that a user could impersonate someone else with malicious intent or to evade detection (I think that they can also be any string (for example, an ip address, or a list of ip addresses, or an ip address and a fragment of a mysql query)).  Only the $_SERVER['REMOTE_ADDR'] part can be relied on.  This variable is assigned by the php server (as opposed to headers sent by the client) and should always be a properly formatted ip address.

[thefluffball]

All the above is true - Plus I thought I'd point out, d3xt3r made a very similar script a while ago.

[Piotr GRD]

Thousands PHP programmers already made such "script" in this or similar way.

[thefluffball]

Thousands PHP programmers already made such "script" in this or similar way.

Yes, but there's one already on this specific forum. It's like say a flash game, it's all over the internet, but you still wouldn't want the same game twice on your website, would you?
P.S. Not trying to malicious, offensive, be ungrateful, lessen your work, mean etc.

[darrenbeige]

"I know your IP address." No, you know what I want you to know, which means you know nothing at all. "I'm telling you 'my' IP address."

Now thats political correctness.