PHP uses CURL to forge source IP address and source URL address program code

Test. Php file

The code is as follows:

Copy code

<? Php Ob_start (); $ Ch = curl_init (); Curl_setopt ($ ch, CURLOPT_URL, "http://www.xxx.cn/test/test2.php "); Curl_setopt ($ ch, CURLOPT_HTTPHEADER, array ('x-FORWARDED-FOR: 1.1.1.1 ', 'client-IP: 2.2.2.2'); // counterfeit IP Curl_setopt ($ ch, CURLOPT_REFERER, "http://www.111cn.net/"); // counterfeit source URL Curl_setopt ($ ch, CURLOPT_HEADER, 1 ); Curl_exec ($ ch ); Curl_close ($ ch ); $ Out = ob_get_contents (); Ob_clean (); Echo $ out; ?>

The test2.php file code is as follows:

The code is as follows:

Copy code

<? Php Function getClientIp (){ If (! Empty ($ _ SERVER ["HTTP_CLIENT_IP"]) $ Ip = $ _ SERVER ["HTTP_CLIENT_IP"]; Else if (! Empty ($ _ SERVER ["HTTP_X_FORWARDED_FOR"]) $ Ip = $ _ SERVER ["HTTP_X_FORWARDED_FOR"]; Else if (! Empty ($ _ SERVER ["REMOTE_ADDR"]) $ Ip = $ _ SERVER ["REMOTE_ADDR"]; Else $ Ip = "err "; Return $ ip; } Echo "<br/> IP :". getClientIp (). "HTTP_CLIENT_IP -:". $ _ SERVER ["HTTP_CLIENT_IP"]. "HTTP_X_FORWARDED_FOR -:". $ _ SERVER ["HTTP_X_FORWARDED_FOR"]. "REMOTE_ADDR -:". $ _ SERVER ["REMOTE_ADDR"]. ""; Echo "<br/> referer:". $ _ SERVER ["HTTP_REFERER"]; ?>

Execution result:

HTTP/1.1 200 OK
Server: DWS/01.03Z33
Date: Mon, 09 Jun 2014 09:27:09 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding

<Br/> IP: 2.2.2.2 HTTP_CLIENT_IP-: 2.2.2.2 HTTP_X_FORWARDED_FOR-: 1.1.1.1
REMOTE_ADDR-: 127.0.0.1 <br/> referer: http://www.111cn.net/

However, it is not possible to forge a scam:

$ _ SERVER ["REMOTE_ADDR"].

Therefore, we recommend that you use $ _ SERVER ["REMOTE_ADDR"] to record IP addresses.