CODEWITHSUNDEEP
phpmysql
Liam
Liam

Reputation: 9855

Referral system

I currently have a website built in PHP, I'm hoping to build a referral system tonight.

My theory is that if I dynamically generate a url and place it on my users' homepage such as

"Referral url = www.mysite.co.uk/referral.php?user=myuser"

Then I could have a script in the page referral.php which gets the username and runs an sql query updating their corresponding row in my table.

The only thing is anybody could then add there own name and sign up multiple accounts.

What is the best way to go about building something like this?

Thanks

Suppose to get the referral url my users had to click a button which generates the referral url as a rand ie mysite.com/refer.php?user=234234, at the same time storing it in a the db.

Once somebody visits the page refer.php, the referrer then gets his credits or benefit added to his row in the db, at the same time setting his referral code to 0, making the code only available once.

Each time he hits the button on his page, his referal code would change.

Would this be valid do you think?

Upvotes: 1

Views: 3921

Answers (4)

Michael B
Michael B

Reputation: 1763

You generally have the right idea, but protecting against fraud in a referral system is difficult. You can check for unique IP addresses in $_SERVER and add that to the database for each request, throwing away duplicates or limiting referrals from IP addresses that don't come from the user who signed up. Like HTTP_REFERRER, this can be spoofed as well with ease (using TOR for example).

It's a tough problem that isn't something you can truly "solve." Like most fraud cases, you can only do your best to mitigate the effect.

EDIT TO ADD: You can also require referrals to "mature" by forcing the referred user to be active on the site for a defined period of time (say, 30 days) to increase the effort of spammers/cheaters. But again, this doesn't "solve" the problem - all you can do is make it tougher for them to game the system. And occasionally, by doing this stuff, you can ruin user experience. So how do you balance it? Tough question. :)

EDIT TO ADDRESS YOUR EDIT: Contemplate the following scenarios if we implement your plan:

1) I click the button and get my code. Then I paste it to... who exactly? One person? That's not particularly good for sharing on Facebook, MySpace (does this exist?), or my personal blog. I have to generate a referral code for EVERY person I send to the site? That not only scales terribly, but is a horrible user experience as well.

2) Let's say I figure out what you're doing. I develop a bot that clicks that button 4 trillion times. What now?

Upvotes: 2

Ondřej Mirtes
Ondřej Mirtes

Reputation: 5661

You can count the referral points for some additional action on your site, for example registration or payment or anything that is behind captcha check.

But do not build any obstacles for your regular legit users!

Upvotes: 0

Joseph Lust
Joseph Lust

Reputation: 19995

You could use the 'HTTP_REFERER' value to check what page the request came from, and only allow votes for that user from their page. This can be spoofed, but most people won't know how.

Upvotes: 0

iliaden
iliaden

Reputation: 3889

you could embed this information in the POSTDATA - it's a tad more secure. Or you can add a restriction that any user may be upvoted ONLY by any other EXISTING user only once. And to make it more "secure", generate userIds with a random seed.

Upvotes: -1

Related Questions