Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 425
  • Last Modified:

Fraud in php click counter

Hi,

I am creating a click counter using a php script so i can log the amount of clicks to a certain url. I need to know this so I can bill my advertisiers.

However, I am aware that one of the main problems with cost per click campaigns is fraud.

I intend to use the $_SERVER['REMOTE_ADDR'] to get the ip address of the 'clicker' & use this to separate unique clicks.

- Is this an acceptable method?
- How can IP addresses be faked?
- What other methods of fraud prevention can i use?

Thanks
0
DrZork101
Asked:
DrZork101
  • 4
  • 4
1 Solution
 
V4nP3rs13Commented:
Here's is the code... you will have to combine it with mysql database and use session to secure your counter against frauds. This visitor is visiting one ip and one session for 24hours. You can also use high IP protection buy using substr(); with the if() to make it more secure.

in the database, make a table "counter" with two fields... "ip" and "date".

Then, here's the code for counting:
<?php
$ip = $_SERVER["REMOTE_ADDR"];
$date = date("d-m-Y");

if((mysql_num_rows(mysql_query("SELECT * FROM counter WHERE ip = '$ip' AND date = '$date'")) == 0) && (!isset($_COOKIE["visitor"]))) {
  mysql_query("INSERT INTO counter VALUES('$ip', '$date')");
  setcookie("visitor","online", time()+3600*24);
}

/* THEN YOU CAN DISPLAY THE AMMOUNT OF VISITORS WITH
echo mysql_num_rows(mysql_query("SELECT * FROM visitors"));
AND THAT WILL DISPLAY THE AMMOUNT OF VISITORS ALL THE TIME */

?>

Open in new window

0
 
DrZork101Author Commented:
Hi,

Thanks for this code.

The added protection of the session cookie is good, however is it possible to write your own cookies?

Also is it possible to spoof your IP?

I just want to know where the security holes live even if it very difficult to plug them.

Thanks

0
 
V4nP3rs13Commented:
Here's the better protection... this will count first three (of four) parts of ip.

111.222.333.444 will be counted as 111.222.333 so this is more secure than my previous code:

<?php
list($a, $b, $c, $d) = explode(".", $_SERVER["REMOTE_ADDR"]);
$ip_fraud = $a.".".$b.".".$c;
$date = date("d-m-Y");

if((mysql_num_rows(mysql_query("SELECT * FROM counter WHERE ip = '$ip_fraud' AND date = '$date'")) == 0) && (!isset($_COOKIE["visitor"]))) {
  mysql_query("INSERT INTO counter VALUES('$ip_fraud', '$date')");
  setcookie("visitor","online", time()+3600*24);
}

/* THEN YOU CAN DISPLAY THE AMMOUNT OF VISITORS WITH
echo mysql_num_rows(mysql_query("SELECT * FROM visitors"));
AND THAT WILL DISPLAY THE AMMOUNT OF VISITORS ALL THE TIME */
?>

Open in new window

0
The Firewall Audit Checklist

Preparing for a firewall audit today is almost impossible.
AlgoSec, together with some of the largest global organizations and auditors, has created a checklist to follow when preparing for your firewall audit. Simplify risk mitigation while staying compliant all of the time!

 
DrZork101Author Commented:
Thanks that looks good!

In relation to my other questions - can IP addresses be spoofed?

Also is there any chance of sql injection via the cookie? I assume not because of just using the isset

Thanks,

Julian
0
 
V4nP3rs13Commented:
IP can be faked through proxys ;)

And my code doesn't have any SQL injection holes... cause it uses isset() instead of if();

So the code is secure from SQL injections through cookie.

Hope I helped you!
0
 
DrZork101Author Commented:
Ok cool, I realise that nothing is trulely secure!

Is there anything I can do to detect proxy ips - charateristics of web request, patterns, blacklists etc?

Thanks
0
 
V4nP3rs13Commented:
I'm afraid there isn't a way to detect proxies, cause they are made to cheat us. So they are created identically like a user is surfing through original IP. Maybe you should try using getenv();

Look here => http://php.net/manual/en/function.getenv.php

and here's the example of the code => http://forums.digitalpoint.com/showthread.php?t=58964
0
 
DrZork101Author Commented:
OK great i will give all of this a go, thanks for all the help!
0

Featured Post

Managing Security Policy in a Changing Environment

The enterprise network environment is evolving rapidly as companies extend their physical data centers to embrace cloud computing and software-defined networking. This new reality means that the challenge of managing the security policy is much more dynamic and complex.

  • 4
  • 4
Tackle projects and never again get stuck behind a technical roadblock.
Join Now