To obtain the user's real IP address, multiple HTTP headers need to be checked first. 1. The function checks the headers such as HTTP_CLIENT_IP, HTTP_X_FORWARDED_FOR, and take the first valid IP; 2. Process multiple comma-separated IPs to verify their legitimacy; 3. If all headers are invalid, use REMOTE_ADDR; 4. For CDN environments such as Cloudflare, HTTP_CF_CONNECTING_IP needs to be processed separately; 5. Note that the header information may be forged and cannot be used for security control. This method is suitable for logging and trend analysis, but cannot guarantee 100% accuracy.

Obtaining user IP addresses is a common requirement in PHP, such as for scenarios such as logging, access control, or user geolocation analysis. However, because HTTP requests may pass through proxy or CDN, simple $_SERVER['REMOTE_ADDR'] cannot cover all cases. Below is a relatively comprehensive PHP function example that can handle multiple proxy situations to obtain the user's real IP.

Basic function: Try to get the user IP address

Here is a commonly used PHP function that checks multiple HTTP headers to get the user's real IP as much as possible:

 function getUserIp()
{
    foreach (array('HTTP_CLIENT_IP', 'HTTP_X_FORWARDED_FOR', 'HTTP_X_FORWARDED', 'HTTP_X_FORWARDED', 'HTTP_X_CLUSTER_CLIENT_IP', 'HTTP_FORWARDED_FOR', 'HTTP_FORWARDED', 'REMOTE_ADDR') as $key) {
        if (!empty($_SERVER[$key])) {
            $ip = $_SERVER[$key];
            // Handle multiple comma-separated IPs, take the first if (strpos($ip, ',') !== false) {
                $ip = exploit(',', $ip)[0];
            }
            // Verify that it is a legal IP address if (filter_var($ip, FILTER_VALIDATE_IP)) {
                return trim($ip);
            }
        }
    }
    return 'Unknown';
}

The idea of this function is: priority is to check the client IP that may be carried in the HTTP request header. If all are invalid, then use REMOTE_ADDR .

Note: Why do you need to check multiple header information?

HTTP requests may pass through intermediate layers such as CDN, reverse proxy, load balancer, etc. At this time, the IP of the original user will be placed in some HTTP headers, such as:

• HTTP_X_FORWARDED_FOR : This is the most common proxy header, and the format is usually "客戶端IP, 代理1, 代理2" .
• HTTP_CLIENT_IP : Some clients may set this header.
• HTTP_FORWARDED : The forwarding header defined by the RFC standard.

However, these headers can be forged, so be extra careful when using them, and it is best to combine them with other verification mechanisms.

Suggestions: Use scenarios and precautions

• Logging : Even if you cannot obtain the real IP 100%, you can record it for analysis of trends.
• Security restrictions : Do not rely on these headers alone for permission control, as they are easily bypassed.
• CDN environment : If your website uses CDN (such as Cloudflare), CDN usually sets the user IP in a specific header, such as HTTP_CF_CONNECTING_IP , which needs to be processed separately.
• IPv6 supports : filter_var() function supports IPv6 address verification, so no additional judgment is required.

Extension: In combination with CDN processing methods (such as Cloudflare)

If you are using Cloudflare, you can add a judgment on HTTP_CF_CONNECTING_IP :

 function getUserIp()
{
    // Cloudflare specific header if (!empty($_SERVER['HTTP_CF_CONNECTING_IP'])) {
        $ip = $_SERVER['HTTP_CF_CONNECTING_IP'];
        if (filter_var($ip, FILTER_VALIDATE_IP)) {
            return $ip;
        }
    }

    foreach (array('HTTP_CLIENT_IP', 'HTTP_X_FORWARDED_FOR', 'HTTP_X_FORWARDED', 'HTTP_X_FORWARDED', 'HTTP_X_CLUSTER_CLIENT_IP', 'HTTP_FORWARDED_FOR', 'HTTP_FORWARDED', 'REMOTE_ADDR') as $key) {
        if (!empty($_SERVER[$key])) {
            $ip = $_SERVER[$key];
            if (strpos($ip, ',') !== false) {
                $ip = exploit(',', $ip)[0];
            }
            if (filter_var($ip, FILTER_VALIDATE_IP)) {
                return trim($ip);
            }
        }
    }
    return 'Unknown';
}

Basically that's it. Although this function cannot obtain the user IP 100% accurately, it is enough in most scenarios. The key is to understand the origins and limitations of each situation.

The above is the detailed content of php function to get user IP address. For more information, please follow other related articles on the PHP Chinese website!