Download the PHP package timefrontiers/php-location without Composer

On this page you can find all versions of the php package timefrontiers/php-location. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:
If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

  • Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
  • To use Composer is sometimes complicated. Especially for beginners.
  • Composer needs much resources. Sometimes they are not available on a simple webspace.
  • If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
  • Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Please rate this library. Is it a good library?

Example code of timefrontiers/php-location

Informations about the package php-location

TimeFrontiers PHP Location

Explicit, privacy-aware IP geolocation for PHP 8.5 applications. Construction never sends a network request, forwarding headers are never trusted by default, and provider results are returned as complete immutable snapshots.

PHP Version

Requirements

Explicit lookup

Inject a configured provider, then call locate() explicitly. Creating the provider or lookup object has no network side effect.

LocationData exposes provider-supplied continent name and code alongside country. Canonical continent codes are AF, AN, AS, EU, NA, OC, and SA. A custom provider that cannot supply continent data may leave both fields empty. Continent is geographic data only; this package does not derive, recommend, or select a currency from it. The caller obtains $trustedClientIp at its host boundary. The package trusts only its configured resolver and does not infer trusted-proxy behavior.

If no IP is supplied, the default resolver reads only REMOTE_ADDR. It ignores Forwarded, X-Forwarded-For, X-Real-IP, and every other forwarding header. A host behind a trusted proxy must inject a ClientIpResolverInterface whose implementation has already applied that host's trusted-proxy policy.

Public lookup uses explicit snapshots of the current IANA IPv4/IPv6 special- purpose and IPv6 allocated-global-unicast registries. It accepts a special range only when IANA marks global reachability affirmatively true; false, blank, conditional, and N/A ranges fail closed. Longest-prefix decisions retain the affirmative anycast allocations inside broader reserved blocks. IPv4- mapped/compatible, 6to4, TEREDO, private-embedded NAT64, unallocated, multicast, documentation, link-local, loopback, and reserved forms are rejected before calling the provider. A local database or application-owned resolver may deliberately inject IpAddressPolicy::allowNonPublic(); public remote services such as IpApiService still enforce public addresses at their own boundary.

The embedded registry snapshot is dated 2025-10-09/10. Review it against the IANA IPv4 special-purpose registry, IANA IPv6 special-purpose registry, and IANA IPv6 global-unicast registry before each release. Registry drift must fail closed and receive corpus tests.

Bounded HTTPS JSON provider

IpApiService is an adapter for the ip-api JSON response shape or a compatible application gateway. It requires an injected transport and an explicit HTTPS endpoint.

The supplied cURL transport permits HTTPS only, verifies TLS, disables redirects, requires an exact host allowlist, rejects private/reserved DNS answers, pins the approved DNS result for the request, bounds connect/total timeouts, and aborts oversized responses. It explicitly disables HTTPS_PROXY, ALL_PROXY, and every other ambient libcurl proxy through handle options, so validated DNS pinning always describes the direct path. Proxying is not a feature of this transport; an application that needs it must supply a separate transport with an explicit proxy allowlist, TLS, authentication, resolution, and redaction policy. IpApiService additionally requires HTTP 200 JSON, validates every consumed field and coordinate, and verifies that the response describes the requested IP.

The public ip-api free endpoint is intentionally unsupported because it is HTTP-only and disallows commercial use. Direct ip-api pro authentication is also not built in because its key is a GET parameter; v1.1 never puts secrets in URLs. Use an application-owned HTTPS gateway that accepts an authorization header, or inject another GeoIPInterface implementation. Authorization is redacted from debug state and provider objects cannot be serialized.

Host enrichment

This package contains no Linktude globals, SQL, schemas, or database dependency. Applications that need their own city/state codes may inject a LocationDataEnricherInterface. An enricher receives a complete immutable snapshot and must return another one, for example with withHostCodes(). Database implementations remain in the host and must use prepared, deterministic queries, distinguish database failure from no match, and escape wildcards if fuzzy matching is deliberately retained.

MaxMind

MaxMindService accepts the narrow MaxMindReaderInterface; use fromDatabase() when geoip2/geoip2 is installed. Capability, path readability, record shape, and coordinate ranges are validated. Continent name and code are read from the MaxMind continent object when present and otherwise left empty; the adapter does not infer continent from country. Raw MaxMind exceptions and database paths are not copied into public errors.

Legacy Location adapter

TimeFrontiers\Location and refresh() remain deprecated migration adapters. Construction no longer performs a lookup. Every public property starts with a safe value, including continent and continent_code, and refresh() assigns a complete validated snapshot only after lookup and enrichment succeed. Failure preserves the previous snapshot, including continent, and records only a safe message with blank file/line fields.

Prefer LocationLookup::locate() and immutable LocationData in new code.

Currency symbols

CurrencySymbols::get() normalizes a code to uppercase and returns a display-only symbol hint. Unknown codes return the normalized code. It is not an ISO currency authority and must not decide settlement currency or money rules. Existing currency_code and currency_symbol fields remain for compatibility; consumers that need currency policy must apply their own configured mapping.

Privacy and retention

An IP address is personal data in many jurisdictions. Before enabling remote lookup, the application owner must document the lawful basis or consent, specific purpose, provider/subprocessor, disclosed fields, geographic precision, cache lifetime, retention period, deletion process, and user notice.

The package provides no cache or persistence by default. Minimize precision and retention, do not log requested IPs, provider bodies, authorization, or exact coordinates unless the documented purpose requires them, and never reuse location collected for one purpose in an unrelated decision.

Quality gates

License

MIT License

All versions of php-location with dependencies

PHP Build Version
Package Version
Requires php Version >=8.5
ext-json Version *
Composer command for our command line client (download client) This client runs in each environment. You don't need a specific PHP version etc. The first 20 API calls are free. Standard composer command

The package timefrontiers/php-location contains the following files

Loading the files please wait ...