php 伪造IP及来源

client.php

<?php

$headers = [ // 构造IP
  'CLIENT-IP: 8.8.8.8',
  'X-FORWARDED-FOR: 8.8.8.8',
];

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, 'http://127.0.0.1:8000/server.php');
curl_setopt($ch, CURLOPT_REFERER, 'http://www.baidu.com/'); // 构造来路
curl_setopt($ch, CURLOPT_HTTPHEADER , $headers);
curl_setopt($ch, CURLOPT_HEADER, false);
curl_exec($ch);
curl_close ($ch);

server.php

<?php

function GetIP(){
  if(!empty($_SERVER['HTTP_CLIENT_IP']))
    $cip = $_SERVER['HTTP_CLIENT_IP'];
  else if(!empty($_SERVER['HTTP_X_FORWARDED_FOR']))
    $cip = $_SERVER['HTTP_X_FORWARDED_FOR'];
  else if(!empty($_SERVER['REMOTE_ADDR']))
    $cip = $_SERVER['REMOTE_ADDR'];
  else
    $cip = '无法获取！';
  return $cip;
}

echo "访问IP: " . GetIP() . "\n";
echo "访问来路: " . @$_SERVER['HTTP_REFERER'] . "\n";