We've tested that blackhole script and it slowed our websites down..... Removed it and sites loading faster. 
Wasn't aware of any SQL injection scripts in the demo script.... Is that the same for the Wordpress plugin? I'm still on v0.5 although i don't have my request script visible.
The original WordPress plugin suffers from same flaw.
$reqIP is used verbatim as returned from
getRealIpAddr() function, which looks HTTP headers usually added by proxy servers. All variables should be escaped before using in queries, even if they seem to come from reliable source and HTTP headers are not one of those.
In short:
$reqIP = getRealIpAddr();
$reqIP = mysql_escape_string($reqIP);
Fortunately, the injection point can't be used to alter database and there is no error output in case of failure, which could allow to scrape whole database.
I suggest removing
getRealIpAddr() and use the real remote address
$_SERVER['REMOTE_ADDR'] unless majority of site visitors are behind a proxy or the site is using a revere proxy.
In that case, the function should be improved to validate input from headers.
<?php
/**
* Determine and validate visitor's IP even behind proxy
* @param bool Pass true to get comma separated list of addresses
* @return string IP address or comma-separated list of addresses
**/
function getRealIpAddr( $all = false ) {
$ips_arr = array_filter(array(
filter_input(INPUT_SERVER, 'HTTP_CLIENT_IP', FILTER_VALIDATE_IP, FILTER_FLAG_NO_RES_RANGE),
filter_input(INPUT_SERVER, 'HTTP_X_FORWARDED_FOR', FILTER_VALIDATE_IP, FILTER_FLAG_NO_RES_RANGE),
filter_input(INPUT_SERVER, 'HTTP_X_FORWARDED', FILTER_VALIDATE_IP, FILTER_FLAG_NO_RES_RANGE),
filter_input(INPUT_SERVER, 'HTTP_FORWARDED_FOR', FILTER_VALIDATE_IP, FILTER_FLAG_NO_RES_RANGE),
filter_input(INPUT_SERVER, 'HTTP_FORWARDED', FILTER_VALIDATE_IP, FILTER_FLAG_NO_RES_RANGE),
filter_input(INPUT_SERVER, 'REMOTE_ADDR', FILTER_VALIDATE_IP, FILTER_FLAG_NO_RES_RANGE)
));
return $all ? implode(',', $ips_arr) : reset($ips_arr);
}
?>
So, there you have it. A function to validate most common headers, get (first or all) valid IP address from HTTP headers or the REMOTE_ADDR as fallback.
