Re: Getting a client's IP address

Thanks for everyone's suggestions - I'll see if I can get something working :-) Brian Tamas Arpad <sts@mail.xubion.hu> wrote in message news:01101613315901.01063@sts.xubion.hu... > On Tuesday 16 October 2001 13:00, Jon Haworth wrote: > > A better method is to use: > > > > if (getenv(HTTP_X_FORWARDED_FOR)) { > > > > $ip=getenv(HTTP_X_FORWARDED_FOR); > > } else { > > $ip=getenv(REMOTE_ADDR); > > } > > > > This way you don't pick up the proxy address. If you then want to > > only allow access from certain IPs you can use something like: > > There's a problem with this aproach. Clients can easily fake > HTTP_X_FORWARDED_FOR headers by just sending the requested ip address > in them. So they'll be identified as a proxy, while they are just > clients sending out fake headers. Of course this doesn't matters if > the computers are on a known intranet with a known a proxy or without > a proxy. > Arpi > > > > > if (!strstr($ip, "192.168.0.")) { > > header("HTTP/1.0 403 Forbidden"); exit; > > } > > > > this would only allow people with 192.168.0.x IPs (common for LANs) > > to access your page. > >