Description: ------------ if (!preg_match("/^[0-9]+$/", $oct[$i])) { Try: if (!is_numeric($oct[$i])) { See: http://talks.php.net/show/php-best-practices/36 Alternatively, this whole script could be replaced by the following script: <?php function checkip ($ip) { return preg_match('/^\s*(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\s*$/m',$ip); } ?>

Instead of if (!is_numeric($oct[$i])) { Try: if (!is_int($oct[$i])) { Obviously is_numeric includes decimals, which is no good here.

Added patch net-checkip-no-regex.

Patch attached. I see no reason not to include this improvement.

Using is_int() is not right here because it only works if the given variable is acutally of type int already: <?php var_dump(is_int("123")); var_dump(is_int(123)); ?> will actually print bool(false) bool(true) If we were to change something in the really really ancient code, we could completely get rid of the preg_match() check, because the next check will work just fine for rejecting any input that is not an integer between 0 and 255.

The idea here is to completely get rid of the preg_match, which isn't required. - if (!preg_match("/^[0-9]+$/", $oct[$i])) { + if (!is_numeric($oct[$i]) || ceil($oct[$i]) != $oct[$i]) {

James, again, what you suggested will not work. <?php $var = "+127"; var_dump(!is_numeric($var) || ceil($var) != $var); ?> will result in bool(false) Thus with your patch the input "+127.0.0.1" will yield a positive return value, which clearly is bogus. Using ctype_digit() will probably work, but I'm hesitating to go this route because I don't intend to add an extension dependency. I suggest you stop investing so much of your time in this old package and focus on Net_CheckIP2 instead. Thanks.