What are potential pitfalls when using $_SERVER['REMOTE_ADDR'] to retrieve IP addresses in PHP?

Using $_SERVER['REMOTE_ADDR'] to retrieve IP addresses in PHP can be unreliable as it can be easily spoofed or manipulated by users. To accurately retrieve the user's IP address, it's recommended to use a combination of $_SERVER['HTTP_CLIENT_IP'], $_SERVER['HTTP_X_FORWARDED_FOR'], and $_SERVER['REMOTE_ADDR'] in a safe and secure manner to ensure the correct IP address is captured. 

function getUserIP() {
    $ip = '';
    
    if (!empty($_SERVER['HTTP_CLIENT_IP'])) {
        $ip = $_SERVER['HTTP_CLIENT_IP'];
    } elseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
        $ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
    } else {
        $ip = $_SERVER['REMOTE_ADDR'];
    }
    
    return $ip;
}

$userIP = getUserIP();
echo "User's IP Address: " . $userIP;

Keywords

$_SERVER['REMOTE_ADDR'] IP address security vulnerability proxy servers client's true IP address

Related Questions