geofiltering to provide location based content - php

Question

I wish to provide location based content i.e I want to allow only users located in Arizona to view the video displayed on my page. However users outside Arizona are also able to view the page.I am using http://freegeoip.net web service to determine users locations from their IP addresses.
This is the code embedded in the webpage
<?php require_once("geofilter.php"); ?>
<?php
if (getRegion()=="Arizona")
//if (getCity()=="Tempe" || getCity()=="Chandler")
{
?>
<iframe src = 'videourl' height='415' width='615' align='top' scrolling='no' frameborder='0'></iframe>
<?php
} else
{
?>
<h1 style="color:#F00">This page is not available in your region: <?php echo (getCity().", ".getRegion());?></h1>
<?php }?>
this is the code for geofilter.php
<?php
function getCountry()
{
$pageContent = file_get_contents('http://freegeoip.net/json/');
$parsedJsonCountry = json_decode($pageContent);
return htmlspecialchars($parsedJsonCountry->country_name);
}
function getRegion()
{
$pageContent = file_get_contents('http://freegeoip.net/json/');
$parsedJsonRegion = json_decode($pageContent);
return htmlspecialchars($parsedJsonRegion->region_name);
}
function getCity()
{
$pageContent = file_get_contents('http://freegeoip.net/json/');
$parsedJsonCity = json_decode($pageContent);
return htmlspecialchars($parsedJsonCity->city);
}
function getZipCode()
{
$pageContent = file_get_contents('http://freegeoip.net/json/');
$parsedJsonZip = json_decode($pageContent);
return htmlspecialchars($parsedJsonZip->zipcode);
}
function getIpAddress()
{
$pageContent = file_get_contents('http://freegeoip.net/json/');
$parsedJsonIp = json_decode($pageContent);
return htmlspecialchars($parsedJsonIp->ip);
}
?>

Answer 1

Do you not need to be passing the client's IP address to this service somehow? From the looks of it, you are just calling a remote endpoint from your server, which without passing client information, would just give the IP address of your server.
I would have thought that even very rudimentary debugging on your part would have shown that you get the same exact results for every call made to the service endpoint from your server.
Also, that code is really poorly structured. There is no reason to potentially call this service for each country, region, etc. determination. Just make the call once up front and store all the Geoip determination information.
So here would be my suggestion:
$client_ip_address = $_SERVER['REMOTE_ADDR']; // or however you get client IP
$geoip_json = file_get_contents('http://freegeoip.net/json/' . $client_ip_address);
$geoip = json_decode($geoip_json);
// you now have geoip object you can work directly with
// no need for a bunch of function wrappers
// example
// $country_name = $geoip->country_name;
if ($geoip->region_code === 'AZ') {
// do whatever
}
Finally, is making a remote service call really what you want to do? It may be OK if you are not expecting a lot of traffic or concerned over the time it takes to load your pages, however, there is no reason you should not be able to use a local GeoIP database to perform these lookups. Take a look at something like this, for better options: https://github.com/maxmind/. Maxmind even offers Apache modules that will have the effect of exposing GeoIP information in $_SERVER superglobal.