Is there anyway to ensure POST data is coming from a specific host?

I have a PHP script where it is pretty important that POST data is coming from a know source. Judging from 'similar titles' there is no real way to do this as head开发者_开发知识库ers can be spoofed. Can SERVER_ADDR be spoofed also? Could this be used as some sort of verification where data is being posted from?

Disregarding PHP, relying on the IP address the request seems to arrive from is a rather weak form of security. You should consider using HTTPS with individual client certificates handed out to each trusted source.

SSL might seem daunting at first, but what you need here is not complicated at all, and you'll be gaining a valuable skill learning it.

if($_SERVER['REMOTE_ADDR'] != '127.0.0.10') {
    die('Not allowed!);
}
// rest of script...

$_SERVER['REMOTE_ADDR'] is not from the client-supplied headers (it's supplied by apache and comes up from the network stack) and can't be spoofed.