On Fri, Apr 23, 2010 at 3:58 PM, Andreas Müller <amuelle1@xxxxxx> wrote: > Hello, > > I know that I can't trust in XFF. What is new for me that the comma is optional and so its more difficult to parse the value. > Could use the function like Perl's split to get the last IP no matter the comma exists or not. $ perl -le '$ip="12.34.56.78,11.22.33.44,1.2.3.4";$last=(split/,/,$ip)[-1];print $last' 1.2.3.4 $ perl -le '$ip="12.34.56.78,11.22.33.44";$last=(split/,/,$ip)[-1];print $last' 11.22.33.44 $ perl -le '$ip="12.34.56.78";$last=(split/,/,$ip)[-1];print $last' 12.34.56.78 -- Jeff Pang http://home.arcor.de/pangj/
