function detect real ip (updated)

[kiss]

 function ip( $default = null, $filter_options = 12582912 )
 {
  $HTTP_X_FORWARDED_FOR = isset( $_SERVER ) ? $_SERVER["HTTP_X_FORWARDED_FOR"] : getenv( 'HTTP_X_FORWARDED_FOR' ) ;
  $HTTP_X_REAL_IP = isset( $_SERVER ) ? $_SERVER["HTTP_X_REAL_IP"] : getenv( 'HTTP_X_REAL_IP' ) ;
  $HTTP_CLIENT_IP = isset( $_SERVER ) ? $_SERVER["HTTP_CLIENT_IP"] : getenv( 'HTTP_CLIENT_IP' ) ;
  $HTTP_X_CLUSTER_CLIENT_IP = isset( $_SERVER ) ? $_SERVER["HTTP_X_CLUSTER_CLIENT_IP"] : getenv( 'HTTP_X_CLUSTER_CLIENT_IP' ) ;
  $HTTP_X_SUCURI_CLIENTIP = isset( $_SERVER ) ? $_SERVER["HTTP_X_SUCURI_CLIENTIP"] : getenv( 'HTTP_X_SUCURI_CLIENTIP' ) ;
  $HTTP_CF_CONNECTING_IP = isset( $_SERVER ) ? $_SERVER["HTTP_CF_CONNECTING_IP"] : getenv( 'HTTP_CF_CONNECTING_IP' ) ;
  $REMOTE_ADDR = isset( $_SERVER ) ? $_SERVER["REMOTE_ADDR"] : getenv( 'REMOTE_ADDR' ) ;
  $all_ips = explode( ",", "$HTTP_X_FORWARDED_FOR,$HTTP_X_REAL_IP,$HTTP_CLIENT_IP,$HTTP_X_CLUSTER_CLIENT_IP,$HTTP_X_SUCURI_CLIENTIP,$HTTP_CF_CONNECTING_IP,$REMOTE_ADDR" ) ;
  foreach ( $all_ips as $ip ) {
   if ( $ip = filter_var( $ip, FILTER_VALIDATE_IP, $filter_options ) )
    break ;
  }
  return $ip ? $ip : $default ;
 } 

[GumSlone]

function fixed, added trim() to ip check.

[GumSlone]

function updated added filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE) which check if the ip is private

[CuteAmit]

hello guys,


why we using HTTP_X_FORWARDED_FOR', 'HTTP_REMOTE_ADDR_REAL', 'HTTP_CLIENT_IP', 'HTTP_X_REAL_IP', 'REMOTE_ADDR, to detect ip ???


all these are similar to REMOTE_ADDR ??

[GumSlone]

I discard everything invalid, even with commas.

function user_ip() {
if (!empty($_SERVER['HTTP_CLIENT_IP'])) {
$ip = $_SERVER['HTTP_CLIENT_IP'];
}
elseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
$ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
}
elseif (!empty($_SERVER['HTTP_X_FORWARDED'])) {
$ip = $_SERVER['HTTP_X_FORWARDED'];
}
elseif (!empty($_SERVER['HTTP_FORWARDED_FOR'])) {
$ip = $_SERVER['HTTP_FORWARDED_FOR'];
}
elseif (!empty($_SERVER['HTTP_FORWARDED'])) {
$ip = $_SERVER['HTTP_FORWARDED'];
} else {
$ip = $_SERVER['REMOTE_ADDR'];
}
if (isset($ip) && !preg_match('/^[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}$/', $ip)) {
$ip = 'ProxyIP';
}
return $ip;
} 

the ip range with comma contains the real ip of opera mini user, i use my function for ip to country detection, because its more correct than the default mod geoip which detects country by remote_addr.

[arnage]

I discard everything invalid, even with commas.

function user_ip() {
if (!empty($_SERVER['HTTP_CLIENT_IP'])) {
$ip = $_SERVER['HTTP_CLIENT_IP'];
}
elseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
$ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
}
elseif (!empty($_SERVER['HTTP_X_FORWARDED'])) {
$ip = $_SERVER['HTTP_X_FORWARDED'];
}
elseif (!empty($_SERVER['HTTP_FORWARDED_FOR'])) {
$ip = $_SERVER['HTTP_FORWARDED_FOR'];
}
elseif (!empty($_SERVER['HTTP_FORWARDED'])) {
$ip = $_SERVER['HTTP_FORWARDED'];
} else {
$ip = $_SERVER['REMOTE_ADDR'];
}
if (isset($ip) && !preg_match('/^[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}$/', $ip)) {
$ip = 'ProxyIP';
}
return $ip;
} 

[GumSlone]

Yeah i was going to say you could use something like:

if(!isset($_SERVER['HTTP_X_OPERAMINI_PHONE_UA']))
         //re-arange array 

however this will also miss poor proxys also
so maybe also an else statement something like:

else if(isset($_SERVER['HTTP_X_FORWARDED_FOR'])&&$_SERVER['HTTP_X_FORWARDED_FOR']!=$_SERVER['REMOTE_ADDR'])
$ip = $_SERVER['HTTP_X_FORWARDED_FOR']; 

also finally to prevent hacking:

return (int)$ip1.'.'.(int)$ip2.'.'.(int)$ip3.'.0'; //REAL IP 

if someone wants to change/hide ip he can do it easily and there is no way to detect a real ip in such cases,
this function is made to detect ip of other 99% normal site users who use opera or use other different proxys to save their traffic costs and not trying to hide their location/ip, you could also add a function which checks if the detected ip is valid and if not then skip back to remote_addr.

[something else]

Yeah i was going to say you could use something like:

if(!isset($_SERVER['HTTP_X_OPERAMINI_PHONE_UA']))
         //re-arange array 

however this will also miss poor proxys also
so maybe also an else statement something like:

else if(isset($_SERVER['HTTP_X_FORWARDED_FOR'])&&$_SERVER['HTTP_X_FORWARDED_FOR']!=$_SERVER['REMOTE_ADDR'])
$ip = $_SERVER['HTTP_X_FORWARDED_FOR']; 

also finally to prevent hacking:

return (int)$ip1.'.'.(int)$ip2.'.'.(int)$ip3.'.0'; //REAL IP 

[GumSlone]

is relying on HTTP_X_FORWARDED_FOR as your first choice to get real ip a good idea ?
As it is probably the most common way of spoofing ip number

well, the HTTP_X_FORWARDED_FOR will work wth all opera mini users.

[something else]

is relying on HTTP_X_FORWARDED_FOR as your first choice to get real ip a good idea ?
As it is probably the most common way of spoofing ip number

[GumSlone]

i have updated the function

[Anshul]

yes it will return the last 0 for all ips,
and it should work with nginx and opera and other proxies, this it the latest function which i am using on my sites,
well,
if you dont want to have the last number in ip =0;
you can simply replace :

    list($ip1,$ip2,$ip3,$ip4) = explode('.',$ip); 
    return $ip1.'.'.$ip2.'.'.$ip3.'.0'; //REAL IP 

by

return $ip; 

also if you dont use apache's mod_geo_ip for ip to coutry detection its better to set last ip value to zero and cache the result of geo ip detection for this ip eg. with memcached, this will reduce the server load.

ok cool i dont use seperate queries for updatin ip anyway its wid last active time anyway i wil giv a try to this

[Leviathan73]

thanks gumslone

[GumSlone]

gumslone.. but they put in the core, or in the user profile?

put it wherever you want to detect the ip

[Leviathan73]

gumslone.. but they put in the core, or in the user profile?