Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

Fraud in php click counter

Posted on 2010-11-26
8
Medium Priority
?
424 Views
Last Modified: 2012-05-10
Hi,

I am creating a click counter using a php script so i can log the amount of clicks to a certain url. I need to know this so I can bill my advertisiers.

However, I am aware that one of the main problems with cost per click campaigns is fraud.

I intend to use the $_SERVER['REMOTE_ADDR'] to get the ip address of the 'clicker' & use this to separate unique clicks.

- Is this an acceptable method?
- How can IP addresses be faked?
- What other methods of fraud prevention can i use?

Thanks
0
Comment
Question by:DrZork101
  • 4
  • 4
8 Comments
 
LVL 6

Expert Comment

by:V4nP3rs13
ID: 34216392
Here's is the code... you will have to combine it with mysql database and use session to secure your counter against frauds. This visitor is visiting one ip and one session for 24hours. You can also use high IP protection buy using substr(); with the if() to make it more secure.

in the database, make a table "counter" with two fields... "ip" and "date".

Then, here's the code for counting:
<?php
$ip = $_SERVER["REMOTE_ADDR"];
$date = date("d-m-Y");

if((mysql_num_rows(mysql_query("SELECT * FROM counter WHERE ip = '$ip' AND date = '$date'")) == 0) && (!isset($_COOKIE["visitor"]))) {
  mysql_query("INSERT INTO counter VALUES('$ip', '$date')");
  setcookie("visitor","online", time()+3600*24);
}

/* THEN YOU CAN DISPLAY THE AMMOUNT OF VISITORS WITH
echo mysql_num_rows(mysql_query("SELECT * FROM visitors"));
AND THAT WILL DISPLAY THE AMMOUNT OF VISITORS ALL THE TIME */

?>

Open in new window

0
 

Author Comment

by:DrZork101
ID: 34216415
Hi,

Thanks for this code.

The added protection of the session cookie is good, however is it possible to write your own cookies?

Also is it possible to spoof your IP?

I just want to know where the security holes live even if it very difficult to plug them.

Thanks

0
 
LVL 6

Accepted Solution

by:
V4nP3rs13 earned 2000 total points
ID: 34216434
Here's the better protection... this will count first three (of four) parts of ip.

111.222.333.444 will be counted as 111.222.333 so this is more secure than my previous code:

<?php
list($a, $b, $c, $d) = explode(".", $_SERVER["REMOTE_ADDR"]);
$ip_fraud = $a.".".$b.".".$c;
$date = date("d-m-Y");

if((mysql_num_rows(mysql_query("SELECT * FROM counter WHERE ip = '$ip_fraud' AND date = '$date'")) == 0) && (!isset($_COOKIE["visitor"]))) {
  mysql_query("INSERT INTO counter VALUES('$ip_fraud', '$date')");
  setcookie("visitor","online", time()+3600*24);
}

/* THEN YOU CAN DISPLAY THE AMMOUNT OF VISITORS WITH
echo mysql_num_rows(mysql_query("SELECT * FROM visitors"));
AND THAT WILL DISPLAY THE AMMOUNT OF VISITORS ALL THE TIME */
?>

Open in new window

0
Threat Trends for MSPs to Watch

See the findings.
Despite its humble beginnings, phishing has come a long way since those first crudely constructed emails. Today, phishing sites can appear and disappear in the length of a coffee break, and it takes more than a little know-how to keep your clients secure.

 

Author Comment

by:DrZork101
ID: 34216524
Thanks that looks good!

In relation to my other questions - can IP addresses be spoofed?

Also is there any chance of sql injection via the cookie? I assume not because of just using the isset

Thanks,

Julian
0
 
LVL 6

Expert Comment

by:V4nP3rs13
ID: 34216539
IP can be faked through proxys ;)

And my code doesn't have any SQL injection holes... cause it uses isset() instead of if();

So the code is secure from SQL injections through cookie.

Hope I helped you!
0
 

Author Comment

by:DrZork101
ID: 34216562
Ok cool, I realise that nothing is trulely secure!

Is there anything I can do to detect proxy ips - charateristics of web request, patterns, blacklists etc?

Thanks
0
 
LVL 6

Expert Comment

by:V4nP3rs13
ID: 34216575
I'm afraid there isn't a way to detect proxies, cause they are made to cheat us. So they are created identically like a user is surfing through original IP. Maybe you should try using getenv();

Look here => http://php.net/manual/en/function.getenv.php

and here's the example of the code => http://forums.digitalpoint.com/showthread.php?t=58964
0
 

Author Comment

by:DrZork101
ID: 34216602
OK great i will give all of this a go, thanks for all the help!
0

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

It’s time for spooky stories and consuming way too much sugar, including the many treats we’ve whipped for you in the world of tech. Check it out!
It’s a season to be thankful, and we’re thankful for users like you who engage on site, solve technology problems, and network with others in the industry. What tech are we most thankful for? Keep reading.
Sometimes it takes a new vantage point, apart from our everyday security practices, to truly see our Active Directory (AD) vulnerabilities. We get used to implementing the same techniques and checking the same areas for a breach. This pattern can re…
Is your data getting by on basic protection measures? In today’s climate of debilitating malware and ransomware—like WannaCry—that may not be enough. You need to establish more than basics, like a recovery plan that protects both data and endpoints.…

971 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question