note 59935 deleted from function.getenv by nlopess

Note Submitter: svpe [at) gmx (dot] net ---- I've read all the comments here. Most of you trust that HTTP_X_FORWARDED_FOR is the real ip address of the user. But it can easily be faked by sending a wrong HTTP request. REMOTE_ADDR does contain the 'real' ip address (maybe of the proxy server but it cannot be faked as easy as X_FORWARDED_FOR) So if you rely on checking the visitor by it's ip address validate _both_ $_SERVER['REMOTE_ADDR'] and $_SERVER['HTTP_X_FORWARDED_FOR'].