[RESOLVED] how can I recognize a domain (a webmaster website) request from within my site ?

quecoder

Hello ,
I want to offer services for webmasters from within my website , let's assume the service is , their users can invite their friends to those webmaster websites using my service that let's the users to input their friends email addresses and type in a personalized invitation message and send it .
what I did is , enabled these webmasters to put a link that opens a pop up window of a page in my website that shows the invitation form and users can send and then close the pop-up window to return to webmaster site.

As I wanted to recognize these webmasters domain names , essentially to both send the invitation with the domain name to where users friends shall go when invited, and to know how much emails this domain has consumed because sending stmp emails are not free, so I should limit their quota to max 100 or so .

I used a very basic function in php to recognize the webmasters by their domains:


$url = $_SERVER['HTTP_REFERER']; 
$domain = parse_url($url);
$domain = $domain['host'];
if( substr($domain, 0, 4) == 'www.') { $domain = substr($domain, 4); }

owner of this domain - $domain - ofcourse had been registered it in my website and I insert the required information in the database.

I know that this is a very basic , but that is because I'm a newbie in PHP so I want to solve these problems :
1 - Webmasters can fake the Referrer address to gain extra messages sent by their users or to use my service when they are not registered at all .
2 - Using just this pop-up to provide my service doesn't let me know much information about the incoming request owner .
3 - How can I use this service to my benefit , or to even increase my PageRank ( does placing a pop-up window link of my website in different webmaster sites increase it ) ?

(Sorry my English sucks)

leatherback

OK, a few answers and questions.
Answers:

1 - Yes. This will always remain true. But why would they? What is in it for them? In any case, Instead of using th referrer address, I would use a webmaster-specific random straing that is passed along, and tell the webmasters that they need toinclude this identifier string in the form

2 - Why would you want to know anything? Also.. If the popup is pased on your site, you can get all the information you can get without asking from the popup. Otherwise: Expand the popup form

3 - A link to your site would benefit your site. however, the link to your popup, would mainly affect the ranking of your popup, which is NOT the most interesting feature of your site, I hope.

You are wondering about monetizing this. You also need to think: Why would anyone use someone elses website to refer visitors' friend (?) to their own website? A feedback form is easy to put together, and us such, webmasters who even think about referring, will build it themselves.

If you make sure your services are usefull, then there is no need to worry about the specifics of individual links: People will include your site as usefull services themselves.

What you might want to do is a URL rewrite on your main name, referring all versions of domain.com; domain.com/index.php, www.domein.com etc to oe form, which will affect the way google-ranking occurs (Note that the above are all different pges according to google ranking

quecoder

leatherback wrote:
OK, a few answers and questions.
Answers:

1 - Yes. This will always remain true. But why would they? What is in it for them? In any case, Instead of using th referrer address, I would use a webmaster-specific random straing that is passed along, and tell the webmasters that they need toinclude this identifier string in the form

2 - Why would you want to know anything? Also.. If the popup is pased on your site, you can get all the information you can get without asking from the popup. Otherwise: Expand the popup form

3 - A link to your site would benefit your site. however, the link to your popup, would mainly affect the ranking of your popup, which is NOT the most interesting feature of your site, I hope.

You are wondering about monetizing this. You also need to think: Why would anyone use someone elses website to refer visitors' friend (?) to their own website? A feedback form is easy to put together, and us such, webmasters who even think about referring, will build it themselves.

If you make sure your services are usefull, then there is no need to worry about the specifics of individual links: People will include your site as usefull services themselves.

What you might want to do is a URL rewrite on your main name, referring all versions of domain.com; domain.com/index.php, www.domein.com etc to oe form, which will affect the way google-ranking occurs (Note that the above are all different pges according to google ranking

yes, I think my service is very useful , it doesn't only send invitations , it also retrieves contact list from the user IM easily . I do the hard work , webmaster only needs to point his user to the pop-up in my website .

As I mentioned , sending smtp mails are not cheap , so , when I limit it for webmaster which I identify them by their domains , using the code I pasted , they will try to fake the referrer to point to another domain that uses my service (in case he did not exceed it's quota -- I know it's very confusing and tedious -- but some domain will get more quotas on demand) and get additional mails sent by their users as invitations .

quecoder

by they way , including a string by the webmaster in his pages , will be visible when viewing source code by any person . he could use the entire form as well.
I want a means by which I can definitely be sure that this request is coming from a specific webmaster .
how can a webmaster sends me information that no other third party can view it ?

leatherback

afaik an email is dirtcheap to sent. It is only a few bytes being send, and your bandwidth would be massive. But well..

The main way I could think of making sure that the form was opened by a certain domain is through some fancy CURL-type linking. But I THINK you are overestimating the amount of traffic & parsing that will happen.

quecoder

leatherback wrote:
afaik an email is dirtcheap to sent. It is only a few bytes being send, and your bandwidth would be massive. But well..

The main way I could think of making sure that the form was opened by a certain domain is through some fancy CURL-type linking. But I THINK you are overestimating the amount of traffic & parsing that will happen.

what do you mean please by afaik an email is dirtcheap to sent. !
*can I use mail() function , and my account will not be suspended if there are huge amounts of e-mails are being sent .. !?

*How can I use the CURL , I only want every site to send it's password to that pop-up and no other one ( third-party) can read it ...

leatherback

[emphasize]I[/emphasize] use the mail() function through the mail server provided by my host. They will start complaining when i am over my , I think, 15Gb traffic a month.

I am sure there are better way to do it, but you could have your client log on to your server, request a random string, which is used in the form. (Say, valid for 30 minute interval). But this makes the whole thing utterly complicated.

Again: What is the use of one of your clients to have this popup thing of yours be spoofed? The email would still be from the URL they provided at signup, and thus useless when used on another site?

quecoder

leatherback wrote:
[emphasize]I[/emphasize] use the mail() function through the mail server provided by my host. They will start complaining when i am over my , I think, 15Gb traffic a month.

I am sure there are better way to do it, but you could have your client log on to your server, request a random string, which is used in the form. (Say, valid for 30 minute interval). But this makes the whole thing utterly complicated.

Again: What is the use of one of your clients to have this popup thing of yours be spoofed? The email would still be from the URL they provided at signup, and thus useless when used on another site?

well , when they fake the referrer address (spoof it) domain name will change as well when is sent by invitation because I use the referrer get the domain dynamically to be sent .

if some one spoofed the referrer ( I know he - the spoofer - will not have any benefit because the spoofed domain will be sent with invitation ) but when I limit it to 100 per domain , he will ruin it for the real owner who will not be able to use his 100 messages. let's assume he is a bad guy ....

but if sending emails are that cheap and does not affect on my account , I will do as you suggest then ...

leatherback

hm..

What I was suggesting is that the users with an account show who they are, and then you use the account details to send the email. Not the referrer URL. As such, the email sent has no value to the person faking/

quecoder

aha thanks
I resolved it
using time stamp of the minute together with the password and posted it in a hidden field after hashing it with md5() ..