note 79359 added to reserved.variables

SECURITY RISK ! Never ever trust the values that comes from $_SERVER. HTTP_X_FORWARDED, HTTP_X_FORWARDED_FOR, HTTP_FORWARDED_FOR, HTTP_FORWARDED, etc.. can be spoofed ! To get the ip of user, use only $_SERVER['REMOTE_ADDR'], otherwise the 'ip' of user can be easily changed by sending a HTTP_X_* header, so user can escape a ban or spoof a trusted ip. Of course this is well know, but I don't see it mentioned in these notes.. If you use the ip only for tracking (not for any security features like banning or allow access to something by ip), you can also use HTTP_X_FORWARDED to get user's ip what are behind proxy. ---- Server IP: 194.246.101.61 Probable Submitter: 82.235.76.7 ---- Manual Page -- http://www.php.net/manual/en/reserved.variables.php Edit -- https://master.php.net/note/edit/79359 Del: integrated -- https://master.php.net/note/delete/79359/integrated Del: useless -- https://master.php.net/note/delete/79359/useless Del: bad code -- https://master.php.net/note/delete/79359/bad+code Del: spam -- https://master.php.net/note/delete/79359/spam Del: non-english -- https://master.php.net/note/delete/79359/non-english Del: in docs -- https://master.php.net/note/delete/79359/in+docs Del: other reasons-- https://master.php.net/note/delete/79359 Reject -- https://master.php.net/note/reject/79359 Search -- https://master.php.net/manage/user-notes.php