Learn from the ticket to get the client IP method _php instance

The first two weeks to help a friend of the relatives of the children to brush tickets, who let us be programmers. This also encountered overloading system, in addition to dust, Taobao shopping, stealing QQ, the next movie, a software why can not be used, and so on, if not, they said your computer technology is not very good, this problem can not solve.

The ticket is divided into various restrictions, registered users, authentication codes, and IP restrictions. This swipe-ticket site, instead, is the polling site that limits the IP. If you want to break the limit, we need to know how to get the user's IP.

getenv (' http_x_forwarded_for ')
getenv (' http_client_ip ')
getenv (' REMOTE_ADDR ')

Http_x_forwarded_for

This is obtained from the HTTP header head, his format is a IP, B IP, C IP. There are two reasons why this is happening

A web site because the traffic is too large, the use of load balancing, so before the application put a load balancer, users can not directly access.
The user uses the proxy to access.
The user first uses a IP, each additional layer of agent, the head will be added to the back of an IP, separated by commas, and finally reached the real web container. As long as the head gets information, it can be forged. So this situation using a IP may not be the user's real IP. So in our case, we can only connect the load balanced IP as the user's real IP, at least this data is correct. But this IP may be the user's proxy IP, not the user's real IP. However, this situation is at least better than the user's fake IP.

Http_client_ip

This is also obtained from header head, originally intended to record the user's real IP, but rarely used.

Remote_addr

This is to get connected IP, only small web site so use, directly to the data leak out, the site is a single point, without any load balance. If the upper layer uses pxory, this data is the proxy IP.

And I do evil is directly forged x-forwarder-for data, and then deceive them, but not a few days later, this loophole was found, and then I replaced the use of the proxy method of direct brush.