problems with cookies

[MrRosary]

Wotcha,

I have a client with a large number of sites. He wants to be able to track users through sites and also from one site to another. He wants to be able to know if a unique customer has visted any of his other sites basically.

I can use cookies etc. within each individual site but of course they dont work from one site to the next as they have different domains and you obviously cant read cookies from another domain unless your very naughty.

I dont really want to use Cross Site Scripting on my own work. Can anyone come up with an alternative?

MrRosary

[evo4ever]

You could write the cookies to a file. Using fwrite(), fopen() and fputs().

Obviously, the script will be writing to the same file on every domain. Im sure that will work.

[ecco]

I haven't tried this myself, but I believe there is a way to make a cookie accessable across sub-domains. While this may not be directly usable in scenario with different domains, it might give you some ideas... Check out this link to PHP.net:

http://www.php.net/manual/sl/function.session-set-cookie-params.php

If you try it, post your results here for others to see....

Take care!

ecco

[MrRosary]

I dont think i made myself quite clear.

All the different sites have different domain names.

I need to be able to tell if someone who previously visited domain name a is now visiting domain name b

Obviously a script on domain name b cannot read a cookie set by domain name a

Perhaps I could write information to a central file or database for each site to track instances of users moving through each site. But once they close their browser there is no way I can be sure it is the same person returning again.

The only way I can think of to do this is to redirect every link on every site through a common page that tracks users with cookies as then all the cookies would be set and read through the same domain for each individual site.

This is going to be slow and look highly suspicious. In effect I am doing a cross site scripting attack on my own sites.

Any further ideas or do I have to admit defeat to the client.

MrRosary

[xblue]

Hi, if you need it just for logging and don't want to generate page content dependent on the cookie information, you could work with tiny invisible images (if that doesn't look too suspicious as well for your purposes).

Just have the img tag point to a php script that is always on the same server, and the php script can handle setting and reading the cookies, log the information needed, and return a transparent graphic.

[MrRosary]

WEB BUGS 😃 😃 😃

Now why didn't I think on that!

I get the feeling I am entering the dark side here.

MrRosary