无论做什么，请确保不要信任从客户端发送的数据. $_SERVER['REMOTE_ADDR']包含连接方的真实IP地址.那是您能找到的最可靠的价值.

但是，它们可以位于代理服务器的后面，在这种情况下，代理可能已设置了$_SERVER['HTTP_X_FORWARDED_FOR']，但是该值很容易被欺骗.例如，它可以由没有代理的人设置，或者IP可以是来自代理后面的LAN的内部IP.

这意味着，如果要保存$_SERVER['HTTP_X_FORWARDED_FOR']，请确保也保存$_SERVER['REMOTE_ADDR']值.例如.通过将两个值保存在数据库的不同字段中.

如果要将IP作为字符串保存到数据库中，请确保至少有 45个字符的空间. IPv6 将保留下来，并且这些地址大于旧的IPv4地址.

(请注意，IPv6通常最多使用39个字符，但也有一种特殊的 IPv6表示法用于IPv4地址(完整形式最多可以包含45个字符).因此，如果您知道自己在做什么，则可以使用39个字符，但是如果您只想设置并忘记它，请使用45). >

How can I get the client IP address using PHP?

I want to keep record of the user who logged into my website through his/her IP address.

Whatever you do, make sure not to trust data sent from the client. $_SERVER['REMOTE_ADDR'] contains the real IP address of the connecting party. That is the most reliable value you can find.

However, they can be behind a proxy server in which case the proxy may have set the $_SERVER['HTTP_X_FORWARDED_FOR'], but this value is easily spoofed. For example, it can be set by someone without a proxy, or the IP can be an internal IP from the LAN behind the proxy.

This means that if you are going to save the $_SERVER['HTTP_X_FORWARDED_FOR'], make sure you also save the $_SERVER['REMOTE_ADDR'] value. E.g. by saving both values in different fields in your database.

If you are going to save the IP to a database as a string, make sure you have space for at least 45 characters. IPv6 is here to stay and those addresses are larger than the older IPv4 addresses.

(Note that IPv6 usually uses 39 characters at most but there is also a special IPv6 notation for IPv4 addresses which in its full form can be up to 45 characters. So if you know what you are doing you can use 39 characters, but if you just want to set and forget it, use 45).