LOL... Are you kidding ?

Never trust your headers. Some evil people can fake it. 

As well - in HTTP_X_FORWARDED_FOR can be more that one IP or in some rare cases - total garbage.