I've read all the comments here.
Most of you trust that HTTP_X_FORWARDED_FOR is the real ip address of the user.
But it can easily be faked by sending a wrong HTTP request.
REMOTE_ADDR does contain the 'real' ip address (maybe of the proxy server but it cannot be faked as easy as X_FORWARDED_FOR)
So if you rely on checking the visitor by it's ip address validate _both_ $_SERVER['REMOTE_ADDR'] and $_SERVER['HTTP_X_FORWARDED_FOR'].