Page 1 of 1

*** Not A Bug *** IP address in contact form

Posted: Mon Oct 28, 2019 5:18 pm
by MGD4me
For a couple of years I had a 'Contact Us' form which generated a basic text email message to our secretary. The message included the IP address of the sender, which proved very helpful in determing the source of spam.

Recently, I changed the format of the message from text, to HTML, which required that I specify each variable manually. i used '$ipaddress' for the sender IP, but this variable sends the IP address of my server, not that of the sender. What is the correct variable name to use, to report the sender IP?

Thanks

Re: IP address in contact form

Posted: Mon Oct 28, 2019 6:17 pm
by Pablo
$ipaddres contains the remote address ($_SERVER['REMOTE_ADDR']), not the server address.

See also:
https://www.php.net/manual/en/reserved. ... server.php

Re: IP address in contact form

Posted: Tue Oct 29, 2019 12:17 am
by MGD4me
I don't know if this makes a difference, but the server is running php version 7.0, and when I request a 'phpinfo', $_SERVER['REMOTE_ADDR'] returns it's own server IP address, not the remote address as I would have thought.

However, scrolling through the phpinfo dump, I noticed that the variable $_SERVER['HTTP_X_REAL_IP'] does in fact provide the desired remote address, so I changed the HTML which gets generated for the 'Contact' page from:

$code = str_replace('$ipaddress', $_SERVER['REMOTE_ADDR'], $code); to read:

$code = str_replace('$ipaddress', $_SERVER['HTTP_X_REAL_IP'], $code);

... and now all is well again (for me).

Regards

Re: *** Not A Bug *** IP address in contact form

Posted: Thu Nov 07, 2019 1:34 am
by MGD4me
Problem solved !!!

After reviewing PHP info on our web server, I noticed that the reported variable $_SERVER['REMOTE_ADDR'] was incorrect. It should have been displaying the remote IP address of the client, when in fact it was showing the server's own IP address.

After contacting the web host company and reporting the issue, they were able to fix the problem at their end, and my temporary 'patch' to the code is no longer required.