Re: $_SERVER['REMOTE_ADDR'] and sql injection
| From: | Ashley Sheridan | Date: | Wed, 23 Jun 2010 14:39:15 +0000 |
| Subject: | Re: $_SERVER['REMOTE_ADDR'] and sql injection | ||
| References: | 1 2 3 4 5 6 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-306368@lists.php.net to get a copy of this message | ||
On Wed, 2010-06-23 at 10:35 -0400, Andrew Ballard wrote:
> On Wed, Jun 23, 2010 at 6:01 AM, Ashley Sheridan
> <ash@ashleysheridan.co.uk> wrote:
> > That's what I'd use. You may also have to wrap it inside an abs() call
> > to ensure it's a positive number, as some IP addresses equate to
> > negative with ip2long().
>
> NO NO NO NO NO!!!!
>
> <?php
>
> $x = ip2long('192.168.0.1');
> var_dump($x);
> // int(-1062731775)
>
> var_dump(long2ip($x));
> // string(11) "192.168.0.1"
>
> var_dump(long2ip(abs($x)));
> // string(13) "63.87.255.255"
>
> ?>
>
> Andrew
>
Someone had better tell all the makers of the ip2country databases then,
because there's not a negative number in sight!
Thanks,
Ash
http://www.ashleysheridan.co.uk