Limit the IP voting program, can not use the web search for PHP to obtain the client IP code to obtain the client IP-reproduced

Limit the IP voting program, can not use the web search for PHP to obtain the client IP code to obtain the client IP-reproduced

the need to get a polling campaign needs to be done IP restrictions, each IP limit a certain chance of voting. I searched the search engine on the keywords:PHP client IP , the results are basically the following:?

?

if (getenv (' http_client_ip ') && strcasecmp (getenv (' http_client_ip '), ' unknown ') {         $onlineip = getenv (' Http_client_ip ');} ElseIf (getenv (' http_x_forwarded_for ') && strcasecmp (getenv (' http_x_forwarded_for '), ' unknown ')) {         $ Onlineip = getenv (' http_x_forwarded_for ');} ElseIf (getenv (' remote_addr ') && strcasecmp (getenv (' remote_addr '), ' unknown ') {         $onlineip = getenv (' Remote_addr ');} ElseIf (Isset ($_server[' remote_addr ") && $_server[' remote_addr '] && strcasecmp ($_server[' Remote_ ADDR '], ' unknown ') {         $onlineip = $_server[' remote_addr ');}

?

This code is used in a wide range of the Discuz "forum software, as well as many open source PHP software will be used, the general idea is to get the final client IP address (for users who have access using the proxy IP address).

???????? because many mature programs use this code to get the client IP address, so I was relieved to use in the program, fortunately, later colleagues reminded that this code can not be used in the limit IP In the voting procedure, because http_x_forwarded_for This can be forged, as long as the request is increased . x-forwarded-for . the $_server[' http_x_forwarded_for ' on the server side receives the content of this request header.

???????? Here I use the program to explain:

???????? http://localhost/i.php content is obtained through the above code to obtain the IP address, and print out.

???????? write the generation that constructs the request, request this URL : In which the request was added x-forwarded-for This parameter

$head = Array (), $head [] = ' get/i.php http/1.1 '; $head [] = ' host:localhost '; $head [] = ' x-forwarded-for:255.255.255.255 '; $head [] = ' connection:close '; $head = Join ("\ r \ n", $head); $head. = "\r\n\r\n"; $fp = Fsockopen (' localhost '), fwrite ($fp, $head); $response = Array (), while ($buff = Fread ($fp, 4096)) {         $response [] = $buff;} Print join (' ', $response);

?

by executing this code, you know that the server-side (localhost/i.php) printed the 255.255.255.255 .

illustrates the acquisition of this client IP the method in limiting IP voting activity is undesirable, the client's IP addresses can be forged. and use it directly ? $_server[' REMOTE_ADDR ' is not a user's final IP address, but the limited functionality is directly and efficiently achieved.

???????? of course, you can't say that the code is wrong. In some of the need for IP restrictions, should be used, for example, in some of the sites have a lot of geographical temperament site, through the user access to the IP, directly to the user's area of the subsite, and so on.

?

?

?

?

?

