Member Avatar for RazorRamon

Hello yall,

I'm starting to work with Paypal (just signed up for x.com and sandbox). I was looking at the DoDirectPayment API for credit card transactions. One of the required fields kinda took me by surprise. Here it is.

IPADDRESS 
 (Required) IP address of the buyer's browser.

Note: 
PayPal records this IP addresses as a means to detect possible fraud.

Character length and limitations: 15 single-byte characters, including periods, for example, 255.255.255.255

How do i obtain the IPaddress of a buyer with PHP?? I'm assuming it can't be as easy as right?? lol

  • 2 Contributors
  • 1 Reply
  • 324 Views
  • 6 Hours Discussion Span
  • Latest Post Latest Post by pzuurveen

Dani AI

Generated

As hinted, PHP’s $_SERVER is the right place to look. The most reliable value tied to the TCP connection is $_SERVER['REMOTE_ADDR']. Headers such as HTTP_X_FORWARDED_FOR or HTTP_CLIENT_IP can carry the original client IP when a proxy/load‑balancer is involved, but they are client‑controlled and should only be trusted when set by a known, trusted intermediary.

A compact, practical extractor that validates and prefers a public IP (falls back to any valid IP) looks like this:

function get_client_ip() {
    $ip = null;

    if (!empty($_SERVER['HTTP_CLIENT_IP'])) {
        $ip = $_SERVER['HTTP_CLIENT_IP'];
    } elseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
        $parts = array_map('trim', explode(',', $_SERVER['HTTP_X_FORWARDED_FOR']));
        foreach ($parts as $candidate) {
            if (filter_var($candidate, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {
                $ip = $candidate; break;
            }
        }
        if (!$ip) { $ip = $parts[0]; }
    } elseif (!empty($_SERVER['REMOTE_ADDR'])) {
        $ip = $_SERVER['REMOTE_ADDR'];
    }

    return filter_var($ip, FILTER_VALIDATE_IP) ? $ip : null;
}

Notes and cautions:

  • Trust REMOTE_ADDR by default; accept X-Forwarded-For only when the proxy/load‑balancer is controlled and configured to provide the original client IP. Otherwise those headers can be spoofed.
  • Validate with filter_var. The FILTER_FLAG_NO_PRIV_RANGE / NO_RES_RANGE flags help choose a public routable IP when available.
  • Keep raw header values in logs for troubleshooting, but send a validated IP to PayPal’s API. If only private/local addresses are present (typical behind NAT), fraud checks may be less useful—configure the infra to forward the client/public egress IP when possible.
  • Tie this back to ’s point: local/private addresses aren’t helpful for fraud detection; prefer the public client IP where available.
Member Avatar for pzuurveen

take alook at $_SERVER

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.