note 59934 deleted from function.getenv by danbrown

Note Submitter: svpe (at] gmx {dot) net ---- I've read all the comments here. Most of you trust that HTTP_X_FORWARDED_FOR is the real ip address of the user. But it can easily be faked by sending a wrong HTTP request. REMOTE_ADDR does contain the 'real' ip address (maybe of the proxy server but it cannot be faked as easy as X_FORWARDED_FOR) So if you rely on checking the visitor by it's ip address validate _both_ $_SERVER['REMOTE_ADDR'] and $_SERVER['HTTP_X_FORWARDED_FOR'].