REMOTE_ADDR注射的可行性

 function getip()
{
if (getenv('HTTP_CLIENT_IP'))
{
$ip = getenv('HTTP_CLIENT_IP'); //可伪造
}
elseif (getenv('HTTP_X_FORWARDED_FOR'))
{
$ip = getenv('HTTP_X_FORWARDED_FOR'); //可伪造
}
elseif (getenv('HTTP_X_FORWARDED'))
{
$ip = getenv('HTTP_X_FORWARDED');
}
elseif (getenv('HTTP_FORWARDED_FOR'))
{
$ip = getenv('HTTP_FORWARDED_FOR');
}
elseif (getenv('HTTP_FORWARDED'))
{
$ip = getenv('HTTP_FORWARDED');
}
else
{
$ip = $_SERVER['REMOTE_ADDR'];
}
return $ip;
}

这个函数在许多php程序可见，然而$_SERVER的很多变量可以伪装，像http开头之类的

//更新登陆IP时间
   $sql = "UPDATE {$table}admin SET lastip='$_SERVER[REMOTE_ADDR]'lastlogin='". time() ."' WHERE userid='$_SESSION[adminid]'";

以上这段代码用来记录登录ip 用的是$_SERVER['REMOTE_ADDR'];
'REMOTE_ADDR'这个参数不能任意伪造

但全局打开的时候，我们可以注射

<?
foreach($_GET as $key => $value) {
$$key =$value;
}
echo $_SERVER[REMOTE_ADDR];

?>

http://gaojohn.blogchina.com/1257809.html