IP & Computer Logging Query

[Tom_Cash]

I currently store the users latest IP in my database. I also store a log of bad attempts to log into my admin panel along with the IP of the place that the attempt came from.

What I want to know is:

Will using $_SERVER['REMOTE_ADDR'] in PHP single my attacker down to one person/computer or will it sometimes read the network or router IP?

Kindest regards,
Tom.

[Alcoholico]

That depends, if the client is behind a proxy REMOTE_ADDR tells you the IP of the proxy, there are some other cases where REMOTE_ADDR fails. Perhaps you should google for "ip detection php".

[Anyango]

Not foolproof but better than plain REMOTE_ADDR

$ip= isset($_SERVER['HTTP_X_FORWARDED_FOR']) ? $_SERVER['HTTP_X_FORWARDED_FOR'] : $_SERVER['REMOTE_ADDR'];

[edit]

That is same as

if(isset($_SERVER['HTTP_X_FORWARDED_FOR']))
{
$ip=$_SERVER['HTTP_X_FORWARDED_FOR'];
}
else
{
$ip=$_SERVER['REMOTE_ADDR'];
}

in case there is any doubt over reusability and readability and what not, about the first code ;)
[/edit]

[edited by: Anyango at 9:14 pm (utc) on Dec. 11, 2008]

[Tom_Cash]

Thanks a lot fellas!

Can I be cheeky, Anyango and ask:

1. Why the first piece of code is wrote like that
and
2. What they both do...

Sorry, still learning and boy, I'm kean. :D

Cheers,
Tom.

[Anyango]

Hey Tom, Sorry in Rush i posted code straight from my Code file and later realized it might be confusing for you.

In simple words thats a compact version of an if/else statement, but lets forget that for now. Lets talk about the 2nd code.

It tries to see if user was using a proxy server ? if it was then it tries to get the actual ip of user and not of proxy server. If that case was false it simply gives you ip address of the user directly from REMOTE_ADDR.

Not really the best solution to block a user but answers your questions

[Tom_Cash]

I really appreciate that! Thanks a lot! It might not be the best soloution but it is much better than what I had! :)

Again, thanks a lot!