Note that both come from the X-Forwarded-For and X-Real-IP HTTP headers, respectively, and can thus be spoofed. It shouldn't matter when using the load balancing server (since they'll add the clients real IP to the headers), but if you ever migrate your code to another server that doesn't use proxied load balancing, you could be opening a hole in your security. Just to be safe, you might want to combine both the real and forwarded remote addresses.
PHP:
function remoteAddr() {
static $remote_addr = null;
if (is_null($remote_addr)) {
$remote_addr = $_SERVER['REMOTE_ADDR'];
foreach (array('HTTP_CLIENT_IP', 'HTTP_X_FORWARDED_FOR', 'HTTP_X_REAL_IP') as $hdr) {
if (isset($_SERVER[$hdr])) {
$remote_addr .= '/' . $_SERVER[$hdr];
break;
}
}
}
return $remote_addr;
}
This won't help you with load-balanced proxies that the client might use, as the remote address might vary with each request, which will appear to be a hijack attempt.