Tracking IP address

[ryanwood4]

Hiya,

 

I'm trying to track the IP address of users leaving comments, however I am struggling to integrate it into the code (below), several attempts have failed.

 

      $_POST['comment'] = str_replace("'", "\'", $_POST['comment']);
      $sql="INSERT INTO articlecomments (articleID, posterNickname, email, comment)
      VALUES ('$_GET[id]','$_POST[name]','$_POST[email]','$_POST[comment]')";
      mysql_query($sql);

 

Any help is, as always, greatly appreciated.

 

Thanks in advance.

[jonsjava]

where are you storing the IP address?  Does your database table have a column for IP address?

[ryanwood4]

Yep: ip | Varchar (20)

 

It's in the same table as the comments: 'articlecomments'

[jonsjava]

here's a safer way to do what you are wanting to do:

<?php
function clearup($input){
if (is_array($input)){
	foreach ($input as $key=>$val){
		$out[$key] = mysql_real_escape_string($val);
	}
}
else{
	$out = mysql_real_escape_string($input);
}
return $out;
}
$post = clearup($_POST);
$get = clearup($_GET);
$ip = $_SERVER['REMOTE_ADDR'];
      $sql="INSERT INTO `articlecomments`(`articleID`, `posterNickname`, `email`, `comment`, `ip`) VALUES ('{$get['id']}','{$post['name']}','{$post['email']}','{$post['comment']}', '$ip')";
      mysql_query($sql);
?>

[ryanwood4]

Cheers, works great.

 

I now know what I was doing wrong too.

 

Thanks.

[jonsjava]

1) You weren't storing the IP address

2) You weren't sanitizing your inputs.