Finding IP Address using JavaScript

[Doug van Vianen]

I recently found the following JavaScript code which is supposed to let one
find then use the ip address of the person accessing the web page containing
the script.

<SCRIPT LANGUAGE="JavaScript">
<!--
var ip = '<!--#echo var="REMOTE_ADDR"-->';

function ipval() {
document.myform.ipadd.value=ip;
}

window.onload=ipval
// -->
</script>

There are various forms of this code which displays the ip address in an
alert box, in a text box in a form, etc but none work for me. When I access
a page with the above in it (along with the appropriate text box in the body
of the page) nothing happens. However, when I view the source of the page
with the browser view item, the source of the page appears with the line

var ip = '<!--#echo var="REMOTE_ADDR"-->';

replaced by the appropriate ip address followed by a ';. The var ip = just
disappeared and the variable ip is not set to anything. I would like the
variable ip set to the address so that I can then do some processing with
it.

Can someone explain what is happening and how I can get this code to work?

Thank you.

Doug van Vianen
(e-mail address removed)

 

[David Dorward]

I recently found the following JavaScript code which is supposed to let
one find then use the ip address of the person accessing the web page
containing the script.

var ip = '<!--#echo var="REMOTE_ADDR"-->';

I am never ceased to be amazed by the number of places which claim that is a
JavaScript way to find out the IP address. It isn't. Its an SSI
<http://www.bignosebird.com/ssi.shtml> way, it just happens to be placed in
the middle of a block of JavaScript, so the value is available to
JavaScript when the page is loaded.

There are various forms of this code which displays the ip address in an
alert box, in a text box in a form, etc but none work for me. When I
access a page with the above in it (along with the appropriate text box in
the body of the page) nothing happens. However, when I view the source of
the page with the browser view item, the source of the page appears with
the line

You have to place the page on a server that supports SSI, and configure it
to parse the HTML document for SSI directives.

 

[Doug van Vianen]

Thank you for your reply.

The web page is on a server that supports SSI so when one views the source
code of the page when viewing it with a browser the ip address does appear.
The problem is that the first part of the JavaScript line containing the
'<!--#echo var="REMOTE_ADDR"-->' (namely, the var ip =) does not appear
although the final ' and ; do appear. Thus the JavaScript variable ip is not
set to the value of the ip address and the rest of the JavaScript coding
does not have the value to process.

Since other people seem to have used this coding I do not understand why it
does not work for me.

Any suggestions? I do not know what 'configure it to parse the HTML document
for SSI directives' means or how to do it.

Thank you.

Doug van Vianen

 

[Richard Cornford]

The web page is on a server that supports SSI so when one views
the source code of the page when viewing it with a browser the
ip address does appear. The problem is that the first part of
the JavaScript line containing the '<!--#echo var="REMOTE_ADDR"-->'
(namely, the var ip =) does not appear although the final '
and ; do appear. Thus the JavaScript variable ip is not set to
the value of the ip address and the rest of the JavaScript
coding does not have the value to process.

Since other people seem to have used this coding I do not
understand why it does not work for me.

<snip>

It is possible that the "hide from older browsers" HTML opening comment
<!-- at the start of the script contents is being taken as the start of
section that needs to be replaced by the SSI. As commenting out script
sections with HTML comments is no longer required removing it and the
final //--> would do no harm.

Richard.

 

[Thomas 'PointedEars' Lahn]

The web page is on a server that supports SSI so when one views
the source code of the page when viewing it with a browser the
ip address does appear. The problem is that the first part of
the JavaScript line containing the '<!--#echo var="REMOTE_ADDR"-->'
(namely, the var ip =) does not appear although the final ' ^^^^^^^^^^^^^^^^^^^^
and ; do appear. [...]

^^^^^^^^^^^^^^^^

It is possible that the "hide from older browsers" HTML opening comment
<!-- at the start of the script contents is being taken as the start of
section that needs to be replaced by the SSI. [...]

I doubt that, since the rest of the script is not replaced by the SSI. For
good reasons the SSI syntax is `<!--#command tag1="value1" tag2="value2"
-->' (note the `#'.) This is a SSI issue, though. The server may support
SSI but either does not serve that variable or serves it as empty string.

The OP should try other SSI variables, check for typos and re-read the SSI
documentation of his webspace provider, if there is any.


PointedEars

 

[Richard Cornford]

The web page is on a server that supports SSI so when one views
the source code of the page when viewing it with a browser the
ip address does appear. The problem is that the first part of
the JavaScript line containing the '<!--#echo var="REMOTE_ADDR"-->'
(namely, the var ip =) does not appear although the final ' ^^^^^^^^^^^^^^^^^^^^
and ; do appear. [...]

^^^^^^^^^^^^^^^^
It is possible that the "hide from older browsers" HTML opening
comment<!-- at the start of the script contents is being taken
as the start of section that needs to be replaced by the SSI. [...]

I doubt that, since the rest of the script is not replaced by the SSI.
For good reasons the SSI syntax is `<!--#command tag1="value1"
tag2="value2" -->' (note the `#'.) This is a SSI issue, though.
The server may support SSI but either does not serve that variable
or serves it as empty string.

From the OPs descripting we have:-

<SCRIPT LANGUAGE="JavaScript">
<!--
var ip = '<!--#echo var="REMOTE_ADDR"-->';

function ipval() {
document.myform.ipadd.value=ip;
}

window.onload=ipval
// -->
</script>

- in the source code, and:-

<SCRIPT LANGUAGE="JavaScript">
';

function ipval() {
document.myform.ipadd.value=ip;
}

window.onload=ipval
// -->
</script>

- arriving at the browsers. And as far as I can see the best explanation
of why the - var ip = ' - part is missing is that the SSI system is
getting confused about which instance of - <!-- - marks its beginning.
That doesn't mean that it would make the same mistake with the - --> -
that terminates it. However, if the SSI was correctly recognising its
declaration but failing for some other reason then I would expect - var
ip = ''; - to be arriving at the browser.

As the SSI is almost certainly working on the file as text and doing its
replacing based on a regular expression it is quite feasible that the
regular expression would find a - <!-- - and look ahead for a -
#command - and then again for the next - --> - to mark the end of the
include, and make exactly the mistake I described if it was too tolerant
of what came between a - <!-- - and the #command. And as writing an SSI
include into HTML comments would be an unusual thing to want to do this
behaviour may have gone unnoticed by the authors of the SSI system. Then
again they might have just put a warning in the documentation not to
nest SSI declarations inside HTML comments.

The OP should try other SSI variables, check for typos and re-read
the SSI documentation of his webspace provider, if there is any.

All reasonable responses to the situation (except maybe any SSI
documentation should have bean read already) but it also wouldn't take
more that 5 minutes to remove the "hide from older browsers" stuff and
determine its significance one way or the other. And as they are no
longer needed, their removal would be no loss if it did turn out to
help.

Richard.

 

[Thomas 'PointedEars' Lahn]

The web page is on a server that supports SSI so when one views
the source code of the page when viewing it with a browser the
ip address does appear. The problem is that the first part of
the JavaScript line containing the '<!--#echo var="REMOTE_ADDR"-->'
(namely, the var ip =) does not appear although the final ' ^^^^^^^^^^^^^^^^^^^^
and ; do appear. [...] ^^^^^^^^^^^^^^^^
It is possible that the "hide from older browsers" HTML opening
comment<!-- at the start of the script contents is being taken
as the start of section that needs to be replaced by the SSI. [...]

I doubt that, since the rest of the script is not replaced by the SSI.
For good reasons the SSI syntax is `<!--#command tag1="value1"
tag2="value2" -->' (note the `#'.) This is a SSI issue, though.
The server may support SSI but either does not serve that variable
or serves it as empty string.

From the OPs descripting we have:-

<SCRIPT LANGUAGE="JavaScript">
<!--
var ip = '<!--#echo var="REMOTE_ADDR"-->';

function ipval() {
document.myform.ipadd.value=ip;
}

[...]

- arriving at the browsers.

No, he wrote:

| The problem is that the first part of the JavaScript line containing the
| '<!--#echo var="REMOTE_ADDR"-->' (namely, the var ip =) does not appear
| [...]

What he posted was only the server-side code, not what the browsers get.


PointedEars

 

[Richard Cornford]

- arriving at the browsers.

No, he wrote:

|The problem is that the first part of the JavaScript line
|containing the '<!--#echo var="REMOTE_ADDR"-->' (namely,
|the var ip =) does not appear [...]

What he posted was only the server-side code, not what the
browsers get.

He also wrote:

|However, when I view the source of the page with the browser
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
|view item, the source of the page appears with the line
|
| var ip = '<!--#echo var="REMOTE_ADDR"-->';
|
|replaced by the appropriate ip address followed by a ';. The
|var ip = just disappeared and the variable ip is not set to
^^^^^^^^^^^^^^^^^^^^^^^^^
|anything.

The detail that needs to be explained (the subject of the OPs question)
remains why the - var ip = ' - part is missing form the source when it
gets to the client. But that code is outside of the SSI declaration and
should not be affected by it. However, my theory does suggest a
mechanism that would have SSI producing the results described.

The theory explains the reported facts better than any alternative
presented and only the OP is in a position to carry out (and report the
results of) and empirical test of it.

Richard.