Search code examples
phpmysqlipipv6ipv4

Encrypting user's IP address before storing it

I'm using PHP and MySQL, and I want to store users' IP addresses into the database for comparison purposes (e.g. allowing only one flag to a thread per IP). Would it be okay to do it the following way?

Retrieving it in PHP:

$ipAddress = md5($_SERVER["REMOTE_ADDR"]);

And then saving it into the database as a VARCHAR(32).

If I had to make a more comprehensive use of the IPs this wouldn't be the proper way to do it I guess, but if it's only to make sure that the same IP didn't do something twice would be okay to use the md5 encryption to simplify things (unifying IPv4 and IPv6 addresses into one)?

Solution

  • Yes, this is fine, though your terminology is wrong: this is hashing, and hashing is not encryption.

    You should also parse the X-FORWARDED-FOR and Client-IP headers unless you want to block everyone behind a proxy as if they were a single user (e.g. everyone at large companies, high schools, etc).