How To Get The Client IP Address In PHP?

Using $_SERVER['REMOTE_ADDR']

The $_SERVER['REMOTE_ADDR'] variable in PHP contains the IP address of the client connecting to the web server. This method is set by the server and not easily changed by the client.

To use this method, access the variable:

$ip_address = $_SERVER['REMOTE_ADDR'];

While $_SERVER['REMOTE_ADDR'] is reliable, it has limits. If the client uses a proxy server or VPN, it may return the IP address of the proxy or VPN server instead of the client's actual IP address.

$ip_address = $_SERVER['REMOTE_ADDR'];
if (filter_var($ip_address, FILTER_VALIDATE_IP)) {
    echo "Valid IP address: $ip_address";
} else {
    echo "Invalid IP address";
}

Using $_SERVER['HTTP_X_FORWARDED_FOR']

The $_SERVER['HTTP_X_FORWARDED_FOR'] header is used when a client connects through a proxy server. It's meant to contain the original IP address of the client.

You can access it like this:

$forwarded_ip = $_SERVER['HTTP_X_FORWARDED_FOR'];

However, this method can be spoofed. Clients can change this header, making it less reliable for security-sensitive applications.

Combining REMOTE_ADDR and HTTP_X_FORWARDED_FOR

Using both methods together can give a more complete picture of the client's IP address. This approach is useful when you need to account for both direct connections and connections through proxy servers.

Here's a simple implementation:

function get_client_ip() {
    $ip = $_SERVER['REMOTE_ADDR'];
    if (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
        $ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
    }
    return $ip;
}

This function first checks the REMOTE_ADDR, then overrides it with HTTP_X_FORWARDED_FOR if it's available. Remember that this method still carries the risk of using a potentially spoofed IP address from HTTP_X_FORWARDED_FOR.

For more secure applications, you might want to log both values separately:

$remote_addr = $_SERVER['REMOTE_ADDR'];
$forwarded_for = $_SERVER['HTTP_X_FORWARDED_FOR'] ?? 'Not set';

This approach allows you to have both pieces of information for later analysis if needed.

function get_client_ip_from_forwarded_for() {
    if (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
        $ip_array = explode(',', $_SERVER['HTTP_X_FORWARDED_FOR']);
        return trim($ip_array[0]);
    }
    return $_SERVER['REMOTE_ADDR'];
}