HTTP_REFERER dilemma

[pawlectro]

I have site where I hold site specific promotions. These promotions are held at a small niche of other websites where my promo page is shown inside a frame on their site.

 

I was using the HTTP_REFERER to get the calling site to make sure that the promo page could only be seen from within that specific site. If my promo page was not being seen from within the site hosting the promo, the user is redirected elsewhere.

 

Recently I found that HTTP_REFERER does not work in IE and can be turned off and even spoofed in other browsers. So I was losing a big audience.

 

So I thought to myself, the site hosting my promo of course would have a static IP. I could look up the hosting site's IP and store that and use that to cross reference the IP when my promo page is called. However, getting that calling site's IP when my page is called is my dilemma. Can PHP get the IP address of the calling site? Is there a function that does not rely on the user-agent and whether or not that user-agent contains referer info or not?

 

[phpSensei]

<?PHPSensei To The Rescue

 

• From my understanding this might be more oriented towards Javascript rather than PHP. If you want to get elements outside the server and access client side information, then using the window.top function in Javascript just might help you. Search up "Javascript parent window IP" or something of that sort.
  
• However I don't see why you need to check if your site is being called, if its your site being loaded it won't matter regardless, your script will be running.
  

 

This is from my understand of your post

 

So What Can I Do Sensei?

 

Use the suggested method above

 

window.top.document.myVariable

 

and

 

document.write(document.referrer);

 

or just actually get the site's Static IP and plug it into PHP

 

[pawlectro]

It appears I should be more clear. 'John' has a site where people view other sites inside a frame. It is a traffic exchange. His members view other people's sites in exchange for them to view theirs.

 

I have a promo site. I am hired by traffic exchange owners, like John, to do this promo where my own list of members go to John's site and view sites every so many seconds.

 

My promo page is inserted into the random views on John's site. My members stumble across my promo page as they are viewing other sites, they enter their special id and get credit for a random drawing, as a reward for being active at John's site.

 

Why I need to know the referring site is because I do not want people to just drop in the link to my promo page into their browser where they can then claim their ticket for the drawing without actively surfing John's site, who paid me for the promo.

 

By being able to, without fail, resolve the referring site, I can ensure that people are not cheating John by not not actually doing the action required to get into the drawing and are likely just dropping in the link to my promo page into their browser.

 

I host multiple promos at the same time, so it is very important that I can resolve the referring site in any way shape or form.

 

I have been using the HTTP_REFERER to check if the site calling my promo page is valid. But since IE by default excludes this info, and other browsers can turn this off, and even spoof this var, I need a way to absolutely know that the site calling my page is one of my customers, so my customers are not being cheated, and also, so I am not losing the IE users.

 

This is why I am looking for a php function, or method, to determine the referring site's IP address that is calling my promo page. If not by IP then any way that I can achieve my goal.

[phpSensei]

Well since IE's method won't work, you can do what you have been doing, but using javascript's http referer for your IE users.

[pawlectro]

I havent tried the javascript 'document.referrer' because I believe that client side info is still grabbed from the same place as on the client that HTTP_REFERER would get that info from, so I would be in the same situation. Am I incorrect?

[pkSML]

Yes, you are correct. But since they're calling the page by a frame, couldn't you just adjust the frame HTML code?

 

for instance

<iframe src="http://pawlectros_site.com/?referrer_id=73825" width="100%" height="300">

[pawlectro]

The frame is not my property. My promo is page is seen in a 3rd party frame. It is the calling domain that owns the frame that I need to identify.