RE: [PHP] Session Theft

Hi Haseeb, > if i can get something from user end that is unique > for that user.for e.g. his/her IP . Firstly, an IP address can be shared between multiple users, or it can change constantly for one user. Here's what a page request from an AOL user looks like (I've snipped the request paths, but left the timestamps and IPs untouched): 205.188.209.165 - - [14/Jan/2003:13:01:36 +0000] 205.188.209.9 - - [14/Jan/2003:13:01:37 +0000] 205.188.208.38 - - [14/Jan/2003:13:01:37 +0000] 205.188.208.134 - - [14/Jan/2003:13:01:38 +0000] 205.188.209.77 - - [14/Jan/2003:13:01:38 +0000] 205.188.208.136 - - [14/Jan/2003:13:01:39 +0000] 205.188.209.48 - - [14/Jan/2003:13:01:40 +0000] 205.188.208.169 - - [14/Jan/2003:13:01:40 +0000] 205.188.209.72 - - [14/Jan/2003:13:01:41 +0000] [...] Notice how the IP changes - they requested the page from 205.188.209.165, and then got each of the images from a separate IP. > but it will not work when they are behind firewall.they will > be assigned same IP.is there a way for me to get the IP (e.g. > 202.202.202.202 thats just an e.g. ) plus computer ip(192.168. > 0.1 e.g.) i saw once a java chat server do this. Instead of just checking the REMOTE_ADDR, try this: <?php if (getenv(HTTP_X_FORWARDED_FOR)) { $ip = getenv(HTTP_X_FORWARDED_FOR); } else { $ip = getenv(REMOTE_ADDR); } echo "Your IP is $ip"; ?> Cheers Jon