curl伪造referer与来源IP

[one.php]
```php
<?php
 $post_data = array (
 "user" => "gongwen",
 "pwd" => "123456"
 );

$header_ip = array(
      'CLIENT-IP:88.88.88.88',
      'X-FORWARDED-FOR:88.88.88.88',
    );

$referer='http://www.bestphper.com';

$ch = curl_init();
    curl_setopt ($ch, CURLOPT_URL, 'http://localhost/curl/two.PHP');

//伪造来源referer
    curl_setopt ($ch,CURLOPT_REFERER,$referer);

//伪造来源ip
    curl_setopt($ch, CURLOPT_HTTPHEADER, $header_ip);

//提交post传参
    curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);

//加上这个表示执行curl_exec是把输出做为返回值,不会输出到浏览器
    curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
    $out_put=curl_exec ($ch);
    curl_close ($ch);
    echo $out_put;
```

[two.php]
```php
<?php
 //请求来源referer
 echo '[HTTP_REFERER] ';
 echo $_SERVER['HTTP_REFERER'];

//请求来源ip
 //[注]此处的IP打印顺序是目前很多开源系统的IP获取顺序 
 echo '<hr>[IP] ';
 echo $_SERVER['HTTP_CLIENT_IP'];
 echo ' ';
 echo $_SERVER['HTTP_X_FORWARDED_FOR'];
 echo ' ';
 echo $_SERVER['REMOTE_ADDR'];

//POST数据
 echo '<hr>[POST] <pre>';
 var_dump($_POST);
 echo '</pre>';
```

浏览器访问one.php。页面打印如下:
![](http://image.gwalker.cn/Uploads_ArticleFiles_20141011_m_54389748671a1.png)

代码下载:[戳我下载](http://image.gwalker.cn/Uploads_ArticleFiles_20141011_54389f5a1b673.rar "戳我下载")