php - $_SERVER['REMOTE_ADDR'] returns false IP -

i making anto-fload script site. cant use service handles fail2ban , like. question regarding $_server['remote_addr'] value. there way function return false ip? heared somewhere possible , want know how thats happening , can prevent it? thats script:

        $ip = $_server['remote_addr'];     $query = "select * `banned_users` `ip`='".$ip."'";     if(mysql_num_rows(mysql_query($query))!=0)die("you have been banned site!");      if(isset($_session['views']) && isset($_session['time']) && $_session['time']>=time()-2)$_session['views']++;     else {         $_session['views']=1;         $_session['time'] = time();     }        if($_session['views']>=15){         $query = "insert `banned_users` values ('',".time().",'".$ip."') ";         mysql_query($query);         die();     } 

as can see, if user makes more 15 refreshes in 2 seconds bans site. question have regarding 15 operations, value? should lower it? since hosting have has bandwidth limits.

thanks.

remote_addr supplied php web server. gets address of incoming ip request.

it accurate, but:

• it can spoofed if knows they're doing , doesn't want traced.

• it can have misleading value if user accessing site via proxy -- address you'll proxy's address rather user's end address. (you may or may not other $_server fields proxy forwarding address, depending on config of proxy. , cannot rely on being accurate)

• if user within own network, nat, firewalls, proxies , other networking systems may result in address think of ip address may not address received site. may ever see single ip address or small range of addresses users within network. include lot of (most) businesses (ie people visiting office), , may include isps, means customers of isp may appear same ip address, , blocking 1 of them may block them all.

[can it] wierd combination of numbers , dots or null or else not ip?

i guess contain ipv6 address. if code expecting ever see ipv4 address, problem. in general, always valid ip address (even it's been spoofed, still need valid in order server accept connection).