1

There is two approaches:

First approach:

if (isset($_SERVER['HTTP_CLIENT_IP']))
    $user_ip = $_SERVER['HTTP_CLIENT_IP'];
else if(isset($_SERVER['HTTP_X_FORWARDED_FOR']))
    $user_ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
else if(isset($_SERVER['HTTP_X_FORWARDED']))
    $user_ip = $_SERVER['HTTP_X_FORWARDED'];
else if(isset($_SERVER['HTTP_FORWARDED_FOR']))
    $user_ip = $_SERVER['HTTP_FORWARDED_FOR'];
else if(isset($_SERVER['HTTP_FORWARDED']))
    $user_ip = $_SERVER['HTTP_FORWARDED'];
else if(isset($_SERVER['REMOTE_ADDR']))
    $user_ip = $_SERVER['REMOTE_ADDR'];
else
    $user_ip = NULL;

// IPs
+----+----------------+-------------+
| id |    user_ip     |  date_time  |
+----+----------------+-------------+
| 1  | 43.12.9.9      | 1468070172  |
| 2  | 173.3.0.1      | 1468070667  |
+----+----------------+-------------+

Second approach:

if (isset($_SERVER['HTTP_CLIENT_IP']))
    $header = $_SERVER['HTTP_CLIENT_IP'];
else if(isset($_SERVER['HTTP_X_FORWARDED_FOR']))
    $header = $_SERVER['HTTP_X_FORWARDED_FOR'];
else if(isset($_SERVER['HTTP_X_FORWARDED']))
    $header = $_SERVER['HTTP_X_FORWARDED'];
else if(isset($_SERVER['HTTP_FORWARDED_FOR']))
    $header = $_SERVER['HTTP_FORWARDED_FOR'];
else if(isset($_SERVER['HTTP_FORWARDED']))
    $header = $_SERVER['HTTP_FORWARDED'];
else
    $header = NULL;

$user_ip = $_SERVER['REMOTE_ADDR'];

// IPs
+----+----------------+----------------+-------------+
| id |    user_ip     |     header     |  date_time  |
+----+----------------+----------------+-------------+
| 1  | 43.12.9.9      | NULL           | 1468070172  |
| 2  | 93.35.40.1     | 173.3.0.1      | 1468070667  |
+----+----------------+----------------+-------------+

So far, I was using the first approach, but an user can simply set a bogus value to one of those HTTP_... headers and in that case I will store a wrong value as user's IP. But in the second approach, I will both store REMOTE_ADDR and one of those HTTP_... headers (that one which isn't empty)., as you know nobody cannot change the value of REMOTE_ADDR, so I guess the second approach will be much better.

So do you think which one is better?

1
  • 1
    IP can change mid-session you know, make sure your app handles that.
    – dandavis
    Commented Jul 10, 2016 at 3:03

1 Answer 1

1

Second one is definitely better compared to the first. But.....i do not know which kind of users you are dealing with because for the average computer user, more people are aware of VPNs and program to hide their identity more than being able to change headers.

In my opinion, i think headers could be more reliable because for the average user, it is easier to just download a VPN program. I do think storing both though is better than not if you really need to know the IP.

Also just keep in mind that both the header and remote could not be authenticate if the user knows what they are doing as far as hiding their identity.

There is a lot more information you can collect to about the user to identify them but like i said it all depends on who your users are and what you are trying to do with that information.

Just some things to think about!

4
  • I see. thanks, upvote. Just one thing about headers; Always one of them is set? I mean others will be empty? Because my code uses if - else, that meas always the first header which isn't empty will be as the user's IP.
    – Martin AJ
    Commented Jul 9, 2016 at 22:51
  • Sorry, is your question, if the headers are always set? Sometimes it depends on if you set up proxy and reverse proxy. Like nginx. the way your if else is structured, as soon as one of them returns true then the rest are skipped. Check out this question stackoverflow.com/questions/3003145/…
    – nd510
    Commented Jul 10, 2016 at 0:18
  • My question: Suppose this $_SERVER['HTTP_X_FORWARDED_FOR'] is containing user's ip. and this $_SERVER['HTTP_CLIENT_IP'] is containing an useless value. My code stores $_SERVER['HTTP_CLIENT_IP'] as user's ip. Right? because it is in the first condition. How can I avoid that?
    – Martin AJ
    Commented Jul 10, 2016 at 0:30
  • 1
    What do you need the IPs for? that could help me better but here is a possible suggestion.....How about instead of if-else, you just do IFs that way it will check all of them and then you just delete any duplicate IPs before saving to the DB. So a User can have many IPs. Make an IP table with a user id attached to each IP to identify. Grab the IP from every header and filter out the duplicates. example: Header 1: NULL; Header 2: 34.2.1.45; Header 3: 34.2.1.45; Header 4: 56.7.8.9; Header 5: 34.2.1.45. Then check for the duplicates then only save 34.2.1.45 and 56.7.8.9
    – nd510
    Commented Jul 10, 2016 at 1:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .