I'm using this PHP code to get a visitor's IP address:
<?php echo $_SERVER['REMOTE_ADDR']; ?>
But, I can't get the real IP address from visitors when they are using a proxy. Is there any way to get a visitor's IP address in this case?
I'm using this PHP code to get a visitor's IP address:
<?php echo $_SERVER['REMOTE_ADDR']; ?>
But, I can't get the real IP address from visitors when they are using a proxy. Is there any way to get a visitor's IP address in this case?
Try this php code.
<?PHP
function getUserIP()
{
// Get real visitor IP behind CloudFlare network
if (isset($_SERVER["HTTP_CF_CONNECTING_IP"])) {
$_SERVER['REMOTE_ADDR'] = $_SERVER["HTTP_CF_CONNECTING_IP"];
$_SERVER['HTTP_CLIENT_IP'] = $_SERVER["HTTP_CF_CONNECTING_IP"];
}
$client = @$_SERVER['HTTP_CLIENT_IP'];
$forward = @$_SERVER['HTTP_X_FORWARDED_FOR'];
$remote = $_SERVER['REMOTE_ADDR'];
if(filter_var($client, FILTER_VALIDATE_IP))
{
$ip = $client;
}
elseif(filter_var($forward, FILTER_VALIDATE_IP))
{
$ip = $forward;
}
else
{
$ip = $remote;
}
return $ip;
}
$user_ip = getUserIP();
echo $user_ip; // Output IP address [Ex: 177.87.193.134]
?>
HTTP_CLIENT_IP
and HTTP_X_FORWARDED_FOR
can be forged. Only REMOTE_ADDR
cannot.
This is the most common technique I've seen:
function getUserIP() {
if( array_key_exists('HTTP_X_FORWARDED_FOR', $_SERVER) && !empty($_SERVER['HTTP_X_FORWARDED_FOR']) ) {
if (strpos($_SERVER['HTTP_X_FORWARDED_FOR'], ',')>0) {
$addr = explode(",",$_SERVER['HTTP_X_FORWARDED_FOR']);
return trim($addr[0]);
} else {
return $_SERVER['HTTP_X_FORWARDED_FOR'];
}
}
else {
return $_SERVER['REMOTE_ADDR'];
}
}
Note that it does not guarantee it you will get always the correct user IP because there are many ways to hide it.
HTTP_X_FORWARDED_FOR
header, which may contain a comma-separated list if the request passed through one or more proxies (according to en.wikipedia.org/wiki/X-Forwarded-For#Format)
Mar 14, 2018 at 13:38
HTTP_X_FORWARDED_FOR
header, it's a good idea to test it with filter_var(trim($addr), FILTER_VALIDATE_IP)
to make sure you at least have a valid IP address before returning it.
Mar 14, 2018 at 13:52
filter_var()
addition: function get_user_IP(): string {
$ip = $_SERVER['HTTP_X_FORWARDED_FOR'] ?? $_SERVER['REMOTE_ADDR'] ?? '';
if (strpos($ip, ',') > 0) {
$addr = explode(',', $ip);
return filter_var(trim($addr[0]), FILTER_VALIDATE_IP);
}
return $ip;
}
[Sorry for the messed-up formatting — I can't post a block of code in here, apparently, just inline code.] Also, if you're using PHP 8.x+ you can replace strpos($ip, ',') > 0
with str_contains($ip, ',')
Nov 17, 2022 at 17:34
This is my approach:
function getRealUserIp(){
switch(true){
case (!empty($_SERVER['HTTP_X_REAL_IP'])) : return $_SERVER['HTTP_X_REAL_IP'];
case (!empty($_SERVER['HTTP_CLIENT_IP'])) : return $_SERVER['HTTP_CLIENT_IP'];
case (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) : return $_SERVER['HTTP_X_FORWARDED_FOR'];
default : return $_SERVER['REMOTE_ADDR'];
}
}
How to use:
$ip = getRealUserIp();
Proxies may send a HTTP_X_FORWARDED_FOR
header but even that is optional.
Also keep in mind that visitors may share IP addresses; University networks, large companies and third-world/low-budget ISPs tend to share IPs over many users.
This is my function.
benefits :
/**
* Get real user ip
*
* Usage sample:
* GetRealUserIp();
* GetRealUserIp('ERROR',FILTER_FLAG_NO_RES_RANGE);
*
* @param string $default default return value if no valid ip found
* @param int $filter_options filter options. default is FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE
*
* @return string real user ip
*/
function GetRealUserIp($default = NULL, $filter_options = 12582912) {
$HTTP_X_FORWARDED_FOR = isset($_SERVER)? $_SERVER["HTTP_X_FORWARDED_FOR"]:getenv('HTTP_X_FORWARDED_FOR');
$HTTP_CLIENT_IP = isset($_SERVER)?$_SERVER["HTTP_CLIENT_IP"]:getenv('HTTP_CLIENT_IP');
$HTTP_CF_CONNECTING_IP = isset($_SERVER)?$_SERVER["HTTP_CF_CONNECTING_IP"]:getenv('HTTP_CF_CONNECTING_IP');
$REMOTE_ADDR = isset($_SERVER)?$_SERVER["REMOTE_ADDR"]:getenv('REMOTE_ADDR');
$all_ips = explode(",", "$HTTP_X_FORWARDED_FOR,$HTTP_CLIENT_IP,$HTTP_CF_CONNECTING_IP,$REMOTE_ADDR");
foreach ($all_ips as $ip) {
if ($ip = filter_var($ip, FILTER_VALIDATE_IP, $filter_options))
break;
}
return $ip?$ip:$default;
}
apply this code for get the ipaddress:
if (getenv('HTTP_X_FORWARDED_FOR')) { $pipaddress = getenv('HTTP_X_FORWARDED_FOR');
$ipaddress = getenv('REMOTE_ADDR');
echo "Your Proxy IP address is : ".$pipaddress. "(via $ipaddress)" ; }
else { $ipaddress = getenv('REMOTE_ADDR'); echo "Your IP address is : $ipaddress"; }
------------------------------------------------------------------------
If the Proxy is which you trust, you can try: (Assume the Proxy IP is 151.101.2.10
)
<?php
$trustProxyIPs = ['151.101.2.10'];
$clientIP = isset($_SERVER['REMOTE_ADDR']) ? $_SERVER['REMOTE_ADDR'] : NULL;
if (in_array($clientIP, $trustProxyIPs)) {
$headers = ['HTTP_CLIENT_IP', 'HTTP_X_FORWARDED_FOR'];
foreach ($headers as $key => $header) {
if (isset($_SERVER[$header]) && filter_var($_SERVER[$header], FILTER_VALIDATE_IP)) {
$clientIP = $_SERVER[$header];
break;
}
}
}
echo $clientIP;
This will prevent forged forward header by direct requested clients, and get real IP via trusted Proxies.
Yes, $_SERVER["HTTP_X_FORWARDED_FOR"]
is how I see my ip when under a proxy on my nginx server.
But your best bet is to run phpinfo()
on a page requested from under a proxy so you can look at all the availabe variables and see what is the one that carries your real ip.
This works for Windows and Linux! It doesn't matter if it's localhost or online..
function getIP() {
$ip = $_SERVER['SERVER_ADDR'];
if (PHP_OS == 'WINNT'){
$ip = getHostByName(getHostName());
}
if (PHP_OS == 'Linux'){
$command="/sbin/ifconfig";
exec($command, $output);
// var_dump($output);
$pattern = '/inet addr:?([^ ]+)/';
$ip = array();
foreach ($output as $key => $subject) {
$result = preg_match_all($pattern, $subject, $subpattern);
if ($result == 1) {
if ($subpattern[1][0] != "127.0.0.1")
$ip = $subpattern[1][0];
}
//var_dump($subpattern);
}
}
return $ip;
}
exec()
and is too complicated without a reason. Getting the visitor's IP does not require so much. Even if you use it to get the server IP, it should be 3 short lines of code to cover windows servers as well as linux.
Jun 22, 2017 at 9:31