其他-What is the most accurate way to retrieve a user's correct IP address in PHP?

21.3k 2020-07-04 05:27:23

Here is a shorter, cleaner way to get the IP address:

function get_ip_address(){
    foreach (array('HTTP_CLIENT_IP', 'HTTP_X_FORWARDED_FOR', 'HTTP_X_FORWARDED', 'HTTP_X_CLUSTER_CLIENT_IP', 'HTTP_FORWARDED_FOR', 'HTTP_FORWARDED', 'REMOTE_ADDR') as $key){
        if (array_key_exists($key, $_SERVER) === true){
            foreach (explode(',', $_SERVER[$key]) as $ip){
                $ip = trim($ip); // just to be safe

                if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) !== false){
                    return $ip;
                }
            }
        }
    }
}

Your code seems to be pretty complete already, I cannot see any possible bugs in it (aside from the usual IP caveats), I would change the validate_ip() function to rely on the filter extension though:

public function validate_ip($ip)
{
    if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) === false)
    {
        return false;
    }

    self::$ip = sprintf('%u', ip2long($ip)); // you seem to want this

    return true;
}

Also your HTTP_X_FORWARDED_FOR snippet can be simplified from this:

// check for IPs passing through proxies
if (!empty($_SERVER['HTTP_X_FORWARDED_FOR']))
{
    // check if multiple ips exist in var
    if (strpos($_SERVER['HTTP_X_FORWARDED_FOR'], ',') !== false)
    {
        $iplist = explode(',', $_SERVER['HTTP_X_FORWARDED_FOR']);
        
        foreach ($iplist as $ip)
        {
            if ($this->validate_ip($ip))
                return $ip;
        }
    }
    
    else
    {
        if ($this->validate_ip($_SERVER['HTTP_X_FORWARDED_FOR']))
            return $_SERVER['HTTP_X_FORWARDED_FOR'];
    }
}

To this:

// check for IPs passing through proxies
if (!empty($_SERVER['HTTP_X_FORWARDED_FOR']))
{
    $iplist = explode(',', $_SERVER['HTTP_X_FORWARDED_FOR']);
        
    foreach ($iplist as $ip)
    {
        if ($this->validate_ip($ip))
            return $ip;
    }
}

You may also want to validate IPv6 addresses.

Corey Ballou 2010-01-09 13:37:05

I definitely appreciate the filter_var fix as it removes a bunch of hackish unsigned int checks on the IP address. I also like the fact it gives me the option of validating IPv6 addresses as well. The HTTP_X_FORWARDED_FOR optimization is also much appreciated. In a few minutes I will update the code.

rook 2011-06-24 23:38:02

-1 this is vulnerable to spoofing all you are doing is asking the user what his ip address should be.

Alix Axel 2011-06-25 01:45:20

@Rook: Yes, I know. The OP is aware of that, and I've also mentioned it in my answer. But thanks for the comment.

darkAsPitch 2011-09-27 08:41:22

FYI: I had to remove FILTER_FLAG_IPV6 to get Alix Axel's code to work.

rook 2016-02-01 11:20:58

@rubenrp81 The TCP socket handler is the only canonical source, everything else is attacker-controlled. The code above is an attacker's dream.

What is the most accurate way to retrieve a user's correct IP address in PHP?

Words of Warning (update)

热门帖子

热门github