⌨️🖱️ UserUser input

YCS has already covered many aspects of the code in terms of taking user input. I agree that using a random string instead of the IP address is likely better for the filename, since the user could alter the value.

If the IP address is taken from $_SERVER['HTTP_X_FORWARDED_FOR'] then it could be filtered and validated using filter_var() with filter ID FILTER_VALIDATE_IP. As YCS mentions at the end of this review there is no point in using that on $_SERVER['REMOTE_ADDR'].

🔀 OperatorOperator Precedence

PHP has two variations for logical AND i.e. and and && (as well as for logical OR: or and ||). Note that and has lower precedence than many other operators including assignment - =.

There is a place near the end where AND is used:

// check if successfully saved, plus sanity check for file name (extension)
if ($outcome > 500 AND substr($file_name, -4) === ".txt") {

This line doesn't appear to be problematic, though as this SO answer illustrates it is wise to use caution and consider which operator variations to use thoughtfully. See also this article by YCS about this matter.

It appears that $outcome is not being assigned in the code posted above. Was it removed after pasting it into the question? Is it supposed to be assigned to the return value from the call to file_put_contents()

🛑 ClosingClosing PHP tag

The last line is a closing PHP tag, which isn't bad but as long as there is only PHP code in the file then it can be left out. The PHP documentation for the PHP tags states:

If a file contains only PHP code, it is preferable to omit the PHP closing tag at the end of the file. This prevents accidental whitespace or new lines being added after the PHP closing tag, which may cause unwanted effects because PHP will start output buffering when there is no intention from the programmer to send any output at that point in the script.