HTTP_X_FORWARDED_FOR check, a secure method for web sites to obtain user IP

Editor to share with you about the web site to obtain user IP security method HTTP_X_FORWARDED_FOR inspection, I hope you will learn something after reading this article, let's discuss it together!

GetIP function after security filtering

The copy code is as follows:

Function getIP () {

$realip =''; / / set the default value

If (isset ($_ SERVER ['HTTP_X_FORWARDED_FOR'])) {

$realip = $_ SERVER ['HTTP_X_FORWARDED_FOR']

} elseif (isset ($_ SERVER ['HTTP_CLIENT_IP'])) {

$realip = $_ SERVER ['HTTP_CLIENT_IP']

} else {

$realip = $_ SERVER ['REMOTE_ADDR']

}

Preg_match ('/ ^ ((?:\ d {1pm 3}\.) {3}\ d {1pm 3}) /', $realip,$match)

Return $match?$match [0]: false

}

The above function, with the addition of IP judgment, will only read data starting with Ip format, and the first one satisfies the IP format value. If no false is returned. In this way, the IP that meets the format can be read, and the IP format of the data is verified.

If I read the IP of the Internet and the user enters the IP of the local area network, I should filter it out directly.

On some websites, we can often see prompts that illegal IP addresses are actually part of the IP address format error, and some may be read to the IP address, which does not meet the IP format allowed on the Internet. The following function, through the IANA site specification, encapsulates a function. By entering the IP address, you can accurately know whether the IP can be applied on the Internet.

The copy code is as follows:

/ / IP addresses are allowed on the Internet

Function ipType2 ($ip) {

$iplist = explode (".", $ip)

If ($iplist [0] > = 224 & & $iplist [0] = 240 & & $iplist [0])