Feasibility of REMOTE_ADDR Injection

Function getip () {if (getenv ('HTTP _ CLIENT_IP ') {$ ip = getenv ('HTTP _ CLIENT_IP '); // forge} elseif (getenv ('HTTP _ X_FORWARDED_FOR ') {$ ip = getenv ('HTTP _ X_FORWARDED_FOR '); // forge} elseif (getenv ('HTTP _ x_forwarded') {$ ip = getenv ('HTTP _ x_forwarded ');} elseif (getenv ('HTTP _ FORWARDED_FOR ') {$ ip = getenv ('HTTP _ FORWARDED_FOR');} elseif (getenv ('HTTP _ forwarded ')) {$ ip = getenv ('HTTP _ forwarded');} else {$ ip = $ _ SERVER ['r EMOTE_ADDR '];} return $ ip;} this function is visible in many php programs. However, many variables of $ _ SERVER can be disguised, // UPDATE the logon IP address time like starting with http $ SQL = "UPDATE {$ table} admin SET lastip = '$ _ SERVER [REMOTE_ADDR]' lastlogin = '". time (). "'where userid = '$ _ SESSION [adminid]'"; the above Code records the logon ip address using $ _ SERVER ['remote _ ADDR ']; the 'remote _ ADDR 'parameter cannot be forged but can be injected globally. <? Foreach ($ _ GET as $ key = >$ value) {$ key = $ value;} echo $ _ SERVER [REMOTE_ADDR];?> Http://gaojohn.blogchina.com/1257809.html