Introduction to the method of obtaining the real IP of the client in php

function getIp(){
 if (getenv("HTTP_CLIENT_IP") && strcasecmp(getenv("HTTP_CLIENT_IP"), "unknown"))
 $ip = getenv("HTTP_CLIENT_IP");
 else if (getenv("HTTP_X_FORWARDED_FOR") && strcasecmp(getenv("HTTP_X_FORWARDED_FOR"), "unknown"))
 $ip = getenv("HTTP_X_FORWARDED_FOR");
 else if (getenv("REMOTE_ADDR") && strcasecmp(getenv ("REMOTE_ADDR"), "unknown"))
 $ip = getenv("REMOTE_ADDR");
 else if (isset($_SERVER['REMOTE_ADDR']) && $_SERVER['REMOTE_ADDR'] && strcasecmp($_SERVER[ 'REMOTE_ADDR'], "unknown"))
 $ip = $_SERVER['REMOTE_ADDR'];
 else
 $ip = "unknown";
 return($ip);
?>

Note: Two functions are used in the above code, getenv() and strcasecmp(). The former function obtains the system environment variable. If the value can be obtained, it returns the value, otherwise it returns false. $_SERVER is the server's super global variable array. You can also use $_SERVER['REMOTE_ADDR'] to obtain the client's IP address. The difference between the two is that getenv does not support PHP running in IIS isapi mode. The usage of the strcasecmp(string1,string2) string function is to compare string1 and string2. If they are equal, 0 is returned. If string1 is greater than string2, a number greater than 0 is returned. If it is less, a number less than 0 is returned. The function first uses the client IP. If it does not work, try to use the proxy method. If it does not work, then use REMOTE_ADDR.

Here is another more detailed method of detecting IPs, which takes into account IP spoofing and multiple proxy codes, in a similar way:

function getip() {
 $unknown = 'unknown';
 if ( isset($_SERVER['HTTP_X_FORWARDED_FOR']) && $_SERVER['HTTP_X_FORWARDED_FOR'] && strcasecmp($_SERVER ['HTTP_X_FORWARDED_FOR'], $unknown) ) {
 $ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
 } elseif ( isset($_SERVER['REMOTE_ADDR']) && $_SERVER['REMOTE_ADDR'] && strcasecmp($_SERVER ['REMOTE_ADDR'], $unknown) ) {
 $ip = $_SERVER['REMOTE_ADDR'];
}
/*
Handle multi-layer proxy situations
or use regular mode: $ip = preg_match("/[d .]{7,15}/", $ip, $matches) ? $matches[0] : $unknown;
*/
if (false !== strpos($ip, ','))
 $ip = reset(explode(',', $ip));
 return $ip;
}
?>

Attachment for reference and study: 1. How to obtain the client IP using PHP without using a proxy server: REMOTE_ADDR = client IP HTTP_X_FORWARDED_FOR = No value or not displayed

2. The use of transparent proxy servers: Transparent Proxies REMOTE_ADDR = Last proxy server IP HTTP_X_FORWARDED_FOR = Client’s real IP (when passing through multiple proxy servers, this value is similar: 221.5.252.160, 203.98.182.163, 203.129.72.215) This type of proxy server still sends the client’s real IP to the access target, which cannot achieve the purpose of hiding the true identity.

3. Using PHP of ordinary anonymous proxy server to obtain client IP: Anonymous Proxies REMOTE_ADDR = Last proxy server IP HTTP_X_FORWARDED_FOR = Proxy server IP (when passing through multiple proxy servers, this value is similar: 203.98.182.163, 203.98.182.163, 203.129.72.215) In this case, the real IP of the client is hidden, but it is revealed to the access objects that the client uses a proxy server to access them.

4. The use of deceptive proxy servers: Distorting Proxies REMOTE_ADDR = proxy server IP HTTP_X_FORWARDED_FOR = Random IP (when passing through multiple proxy servers, this value is similar: 220.4.251.159, 203.98.182.163, 203.129.72.215) In this case, it is also revealed that the client uses a proxy server, but fabricates a fake random IP (220.4.251.159) instead of the client's real IP to deceive it.

5. Using PHP with high anonymity proxy server to obtain client IP: High Anonymity Proxies (Elite proxies) REMOTE_ADDR = proxy server IP HTTP_X_FORWARDED_FOR = No value or not displayed

Whether it is REMOTE_ADDR or HTTP_FORWARDED_FOR, these header messages may not be available because different browsers and different network devices may send different IP header messages. Therefore, PHP uses $_SERVER["REMOTE_ADDR"] and $_SERVER["HTTP_X_FORWARDED_FOR" ] The value obtained may be a null value or an "unknown" value.