What are the potential issues with using $_SERVER['REMOTE_ADDR'] to determine a user's IP address in PHP?

Using $_SERVER['REMOTE_ADDR'] to determine a user's IP address in PHP can be unreliable as it can be easily spoofed or manipulated by users. To ensure a more accurate method of retrieving the user's IP address, you can use a combination of $_SERVER['HTTP_X_FORWARDED_FOR'] and $_SERVER['REMOTE_ADDR'] to check for the real IP address. 

if (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
    $ip_address = $_SERVER['HTTP_X_FORWARDED_FOR'];
} else {
    $ip_address = $_SERVER['REMOTE_ADDR'];
}

Keywords

$_SERVER REMOTE_ADDR IP address security vulnerability data validation

Related Questions