php 如何避免用户访问请求伪造ip,php - 如何避免用户访问请求伪造ip

怪我咯2017-04-10 13:13:194楼

REMOTE_ADDR 没那么容易伪造.

请参见

Can $_SERVER['REMOTE_ADDR'] be trusted?

http://stackoverflow.com/questions/58...

"HTTP_" 开头的$_SERVER很容易伪造.

服务段判断还是挺容易的. 其实下面这个代码也是判断是否使用proxy.

if (

$_SERVER['HTTP_X_FORWARDED_FOR']

|| $_SERVER['HTTP_X_FORWARDED']

|| $_SERVER['HTTP_FORWARDED_FOR']

|| $_SERVER['HTTP_CLIENT_IP']

|| $_SERVER['HTTP_VIA']

|| in_array($_SERVER['REMOTE_PORT'], array(8080,80,6588,8000,3128,553,554)))

|| @fsockopen($_SERVER['REMOTE_ADDR'], 80, $errno, $errstr, 30))

{

echo "we caught you";

}

?>

结论:服务段最好只取$_SERVER['REMOTE_ADDR']

------------------------小插曲---------------------

最近帮人研究一下discuz的xplus投票系统.

function _get_client_ip() {

$clientip = '';

if(getenv('HTTP_CLIENT_IP') && strcasecmp(getenv('HTTP_CLIENT_IP'), 'unknown')) {

$clientip = getenv('HTTP_CLIENT_IP');

} elseif(getenv('HTTP_X_FORWARDED_FOR') && strcasecmp(getenv('HTTP_X_FORWARDED_FOR'), 'unknown')) {

$clientip = getenv('HTTP_X_FORWARDED_FOR');

} elseif(getenv('REMOTE_ADDR') && strcasecmp(getenv('REMOTE_ADDR'), 'unknown')) {

$clientip = getenv('REMOTE_ADDR');

} elseif(isset($_SERVER['REMOTE_ADDR']) && $_SERVER['REMOTE_ADDR'] && strcasecmp($_SERVER['REMOTE_ADDR'], 'unknown')) {

$clientip = $_SERVER['REMOTE_ADDR'];

}

preg_match("/[\d\.]{7,15}/", $clientip, $clientipmatches);

$clientip = $clientipmatches[0] ? $clientipmatches[0] : 'unknown';

return $clientip;

}

呵呵...