function getIP() { # list of bad IP patterns proxies (which could inflate stats) from RFC1918 $badips = Array("^127.","^10.","^172.16.","^172.17.","^172.18.","^172.19.","^172.2","^172.30","^172.31","^192.168."); if(isset($_SERVER['HTTP_VIA'])) { if(isset($_SERVER['HTTP_X_FORWARDED_FOR'])) { $x = 0; while(!isset($ip)) { $badip = $badips[$x]; # if the proxy is serving private IP blocks, it's probably a legit company firewall. # log the proxy IP address and give them credit. it's assumed they can't cheat since # the IPs behind the proxy will be private. if(ereg($badip, $_SERVER['HTTP_X_FORWARDED_FOR'])) { $ip = $_SERVER['REMOTE_ADDR']; } # if the proxy isn't serving private IP blocks, consider it legit. if($x == count($badips)-1) { $ip = $_SERVER['HTTP_X_FORWARDED_FOR']; } $x++; } } else { # anonymous proxies don't pass the X-Forwarded-For header. $ip = ""; } } else { # no proxy. $ip = $_SERVER['REMOTE_ADDR']; } return $ip;}