One Question

or are there any reasons that this will not work?

Nice Class - Best Regards

Hello Gaffling,
an attacker may ignore the session cookie, so the session could be generated for a new session id on every request.
So the script would the every attackers request as it hits the page for the first time.

You may use additional security methods relying on session, e.g. a captcha or something else.

mfg

Hello Till,

Thanks for the detailed answer

Best Regards

What do you think about such a function to get the IP of an user?

function ip(){
switch(true){
case (!empty($_SERVER['HTTP_X_REAL_IP'])) : return $_SERVER['HTTP_X_REAL_IP'];
case (!empty($_SERVER['HTTP_CLIENT_IP'])) : return $_SERVER['HTTP_CLIENT_IP'];
case (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) : return $_SERVER['HTTP_X_FORWARDED_FOR'];
case ($_SERVER['REMOTE_ADDR']== '::1') : return '127.0.0.1';
default : return $_SERVER['REMOTE_ADDR'];
}
}

Is it better than only $_SERVER['REMOTE_ADDR'] ?

Hi Gaffling,
I would say it depends on your implementation. If you focus on the clients IP or the proxy.

X-Forwarded-For is just a http header, it may depend on the proxy if you rely on it.

stackoverflow.com/questions/1145293 ...

So I'm not quite sure.