How to know or ensure that a php page is only called by localhost?

Question

Should we check $_SERVER['REMOTE_SERVER'] or what?

Are you basically saying you only want the script to be accessed from the local server? I don't fully understand & With your reputation, you should know how posting questions works here? What have you tried? — Daryl Gill, Jan 16 '13 at 14:53
You should simply make sure your web server is only accessible by `localhost`. — Jon, Jan 16 '13 at 14:53

score 4 · Accepted Answer · answered Jan 16 '13 at 14:57

4

This will do the trick:

if($_SERVER['REMOTE_ADDR'] === '127.0.0.1') {
    // do something
}

Be careful you don't rely on X_FORWARDED_FOR as this header can be easily (and accidentally) spoofed.

The correct way to do this would be to set an environmental variable in your server configuration and then check that. This will also allow you to toggle states between a local environment, staging and production.

answered Jan 16 '13 at 14:57

Dean

5,884
2
18
24

Although the problem is, I'm sure it's not too difficult to spoof your IP to PHP. Not much you can really do about that though I suppose. – EM-Creations Jan 16 '13 at 16:44
I'm unaware of any method to spoof REMOTE_ADDR at the time of writing. It is gathered by the server and not sent by the client – Dean Jan 16 '13 at 21:18
It's gathered by the server, yes; but it's the client it gathers that information from and spoofing IP addresses is not difficult to do. I'm just mentioning this, but I doubt there's anything that can be done about that from the programmer's perspective. – EM-Creations Jan 17 '13 at 10:54
Spoofing IP addresses to inject into this paramater is incredibly difficult to do. See this: http://stackoverflow.com/a/4774023/775007 – Dean Jan 17 '13 at 14:48
Okay, fair enough I was wrong as to how hard it is to do, but it is still possible; I've already said anyway there's very little; if anything the programmer (you) can do about it, so don't worry. – EM-Creations Jan 17 '13 at 16:28
When i call the page in chrome on the same machine where the xampp server is, $_SERVER['REMOTE_ADDR'] is ``::1`` - so its not working for me... – biberman Jul 12 '22 at 08:25

score 1 · Answer 2 · answered Jan 16 '13 at 18:52

1

This code will help you.

<?php
if($_SERVER['SERVER_NAME'] == 'localhost')
{
    echo 'localhost';
}
?>

answered Jan 16 '13 at 18:52

Ankit Agrawal

6,034
6
25
49

score 0 · Answer 3 · edited May 23 '17 at 12:24

0

Check

$_SERVER['REMOTE_ADDR']=='127.0.0.1'

This will only be true if running locally. Be aware that this means local to the server as well. So if you have any scripts running on the server which make requests to your PHP pages, they will satisfy this condition too.

refered from : How to check if the php script is running on a local server?

edited May 23 '17 at 12:24

Community

1
1

answered Jan 16 '13 at 14:54

Engineer

5,911
4
31
58

How to know or ensure that a php page is only called by localhost?

3 Answers3