PHP 偽造 IP 與 Referer 請求頭完整技術匯總

爬蟲、測試、API 對接常需偽造客戶端 IP 與 Referer。本文匯總 cURL、fsockopen、Stream Context 三種底層實作方式，並詳細列出 cURL 關鍵選項對照表與代理、SSL、認證等進階場景。

方法一：cURL（推薦、功能最完整）

<?php
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, 'https://example.com/search.asp?page=3&keyword=test');
curl_setopt($ch, CURLOPT_REFERER, 'https://example.com/');  // 偽造 Referer
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'CLIENT-IP: 1.2.3.4',           // 偽造 IP（需對方支援）
    'X-FORWARDED-FOR: 1.2.3.4',
]);
$result = curl_exec($ch);
curl_close($ch);
?>

方法二：fsockopen（原始 Socket，無需擴充）

<?php
$host = 'example.com';
$target = '/test.asp';
$referer = 'https://example.com/';

$fp = fsockopen($host, 80, $errno, $errstr, 30);
if ($fp) {
    $out = "GET $target HTTP/1.1\r\n";
    $out .= "Host: $host\r\n";
    $out .= "Referer: $referer\r\n";
    $out .= "X-FORWARDED-FOR: 1.2.3.4\r\n";
    $out .= "Connection: Close\r\n\r\n";
    fwrite($fp, $out);
    while (!feof($fp)) echo fgets($fp, 1024);
    fclose($fp);
}
?>

方法三：Stream Context（PHP 內建，簡潔）

<?php
$context = stream_context_create([
    'http' => [
        'method' => 'POST',
        'header' => "Content-type: application/x-www-form-urlencoded\r\n" .
                    "Referer: https://example.com/\r\n" .
                    "X-FORWARDED-FOR: 1.2.3.4\r\n",
        'content' => http_build_query(['key' => 'value']),
    ]
]);
$result = file_get_contents('https://example.com/api', false, $context);
?>

cURL 關鍵選項完整對照表

進階場景範例

POST 表單提交

<?php
$fields = ['lname'=>'Wang', 'fname'=>'Ming', 'email'=>'test@example.com'];
$fields_string = http_build_query($fields);

$ch = curl_init('https://example.com/submit.php');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $fields_string);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$result = curl_exec($ch);
curl_close($ch);
?>

HTTPS + 代理 + 認證

<?php
$ch = curl_init('https://api.example.com/data');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_PROXY, 'proxy.example.com:8080');
curl_setopt($ch, CURLOPT_PROXYUSERPWD, 'user:pass');
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0); // 測試環境關閉驗證
$result = curl_exec($ch);
curl_close($ch);
?>

完整封裝函數（支援代理、超時、標頭自訂）

<?php
function curlRequest($url, $postFields = '', $proxy = '') {
    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $url);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
    curl_setopt($ch, CURLOPT_TIMEOUT, 25);
    curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0 (compatible; PHP Bot)');
    curl_setopt($ch, CURLOPT_HTTPHEADER, [
        'Accept-Language: zh-CN',
        'Connection: Keep-Alive',
        'Cache-Control: no-cache'
    ]);
    if ($postFields) {
        curl_setopt($ch, CURLOPT_POST, 1);
        curl_setopt($ch, CURLOPT_POSTFIELDS, $postFields);
    }
    if ($proxy) curl_setopt($ch, CURLOPT_PROXY, $proxy);
    $result = curl_exec($ch);
    $info = curl_getinfo($ch);
    curl_close($ch);
    if ($info['http_code'] == 405) die("Bad proxy: $proxy");
    return $result;
}
?>

注意事項與法律提醒

• 偽造 IP/Referer 可能違反目標網站服務條款，請確認授權範圍
• 多數反爬蟲系統會驗證 X-FORWARDED-FOR 真實性，單純偽造標頭效果有限
• 大規模抓取請使用代理 IP 池、控制頻率、遵守 robots.txt
• HTTPS 環境下偽造標頭需確保 SSL 驗證配置正確