You should use the getenv () method instead of $ _SERVER.
function _ip( ) { if (preg_match( "/^([d]{1,3}).([d]{1,3}).([d]{1,3}).([d]{1,3})$/", getenv('HTTP_X_FORWARDED_FOR')) { return getenv('HTTP_X_FORWARDED_FOR'); } return getenv('REMOTE_ADDR'); }
In addition, I would only stick with $ip = getenv('REMOTE_ADDR') , since spammers themselves can set the HTTP_X_FORWARDED_FOR header to whatever they want, while they cannot change remote_addr. The problem is that the “good” proxies tell the truth about HTTP_X_FORWARDED_FOR so you skip this.
source share