Like that???the following?
if (($ip=filter_input(INPUT_SERVER, 'REMOTE_ADDR', validate_ip))===false === false or empty($ip)) { exit; exit; } echo $ip; PS
if (($ip=filter_input(INPUT_SERVER, 'REMOTE_ADDR', FILTER_VALIDATE_IP|FILTER_FLAG_NO_PRIV_RANGE|FILTER_FLAG_NO_RES_RANGE))===false === false) { header('HTTP/1.0 400 Bad Request'); exit; } All headers beginning with 'HTTP_' or 'X-' may be spoofspoofed, respectively is user defined. If you want to keep track, use cooiescookies, etc.