I’m interested in developing a simple system for gathering and potentially blocking IPs. Not a definitive measure I understand but decent enough for hindering negative users and on a small scale site I don’t think it’d be a huge issue.
At the moment I am thinking of only gathering the IP when a user makes a comment so it can be used to prevent spamming posts.
I have so far three pieces of code, one for gathering the IP, one for blocking and unblocking an IP on a list that would be used from a backend cms and one for checking the current IP against the blacklist when they try to use any of the interactive features, preventing them doing so.
/** Collect the user's IP to allow for restricting them from making multiple posts, comments, votes. **/
function getUserIP() {
if (!empty($_SERVER['HTTP_CLIENT_IP'])) //check ip from share internet
{
$ip=mysql_real_escape_string($_SERVER['HTTP_CLIENT_IP']);
}
elseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) //to check ip is pass from proxy
{
$ip=mysql_real_escape_string($_SERVER['HTTP_X_FORWARDED_FOR']);
}
else
{
$ip=mysql_real_escape_string($_SERVER['REMOTE_ADDR']);
}
return $ip;
}
/** Add an IP to a black list to prevent a user participating in comments/rating. **/
function manageUserIP($ip, $status) {
if ($status = "Deny") {
mysql_query("INSERT INTO ipmeta (ip_address,status) VALUES ('$ip','$status'") or die(mysql_error());
}
elseif ($status = "Release") {
mysql_query("DELETE * FROM ipmeta WHERE ip_address='$ip'") or die(mysql_error());
}
else {
return false;
}
}
/** If IP restriction is enabled, prevent the same IP from commenting or rating more than once per post or blocked IPs from doing anything **/
function checkUserIP() {
$ip = getUserIP();
mysql_query("SELECT status FROM ipmeta WHERE ip_address='$ip'") or die(mysql_error());
$row = mysql_fetch_array($result);
$status = stripslashes($row['status']);
if ($status="Deny") {
echo "Your IP, ".$ip.", appears to have been restricted from participating in this feature.<br />If you believe this to be in error, try contacting the administrator.";
exit;
}
else {
exit;
}
}
So what I am after is critique and advice on where I could go from here or how to refine the current code if this is suitable enough for basic IP management. For instance I’ve seen some systems that use an array of IPs to check against but if you had a lot of them it seems like that could be quite a substantial array and little easier than checking against a DB.