Getip () vulnerability code (for proud programmers)

Some time ago, when I was reading py, I went to this friend's blog. When I went to my blog today to see what information was updated, I saw that he sent an IP address. Because I am engaged in web security, I have seen many getip vulnerabilities and the code is copied online. Sure enough, I found a similar vulnerability in this Code.

<? Php/*** get the user's real IP Address */function getIP () {static $ realip; if (isset ($ _ SERVER )) {if (isset ($ _ SERVER ["HTTP_X_FORWARDED_FOR"]) {$ realip = $ _ SERVER ["HTTP_X_FORWARDED_FOR"];} else if (isset ($ _ SERVER ["HTTP_CLIENT_IP"]) {$ realip = $ _ SERVER ["HTTP_CLIENT_IP"];} else {$ realip = $ _ SERVER ["REMOTE_ADDR"] ;}} else {if (getenv ("HTTP_X_FORWARDED_FOR") {$ realip = getenv ("HTTP_X_FORWARDED_FOR ");} else if (getenv ("HTTP_CLIENT_IP") {$ realip = getenv ("HTTP_CLIENT_IP");} else {$ realip = getenv ("REMOTE_ADDR ");}} return $ realip ;}

 

A huge copy of the world's code... HTTP_X_FORWARDED_FOR HTTP_CLIENT_IP can be forged. If SQL injection is not displayed in the background, SQL injection and xss can be performed in the background.
Why is the title of this article dedicated to proud programmers. Because programmers are arrogant, the program he wrote has a bug. When someone asks a programmer, the programmer will immediately think, fuck, will this dumb use my program? I also said that my program has bugs. When I asked the program for the second time, the programmer thought, "is it my own problem. This is the case for many programmers. Don't worry about it. Thank you.