Click tracker help

[madhead29]

Hi all, I have a click tracker and I want to make it alot more advanced than it is now. I cant get my head around the best way to expand the current system and make it do what I want. Basicly a calender type layout and then display the information for the month (get month informatio using php). Link names down the site and then the days across the top can also select stats for different months or years. tbh I want a calender type layout but not 100% sure how it will work yet.

Currently i have two tables for the system:

links: with fields: id,title,ref(which is the page the user is sent to after they click the link) and date added (date the link was added to tracker)

links_info:with fields, id(which is the id of the link the user has clicked),ip (ip of users to check if they have clicked that link before) and date which is the date they clicked the link.

Any help is much appreciated. Also anyone feel free to use this code for your own projects.

code:

mysql_connect($host,$user,$pass) or die (mysql_error()); // try to connect to database
mysql_select_db($db); // try to select the database with the link details

$id = stripslashes($_GET['id']);

if(!$id)
exit; // if the link was not specified, stop runing

$id = stripslashes($id); // for security reasons

$linkquery = mysql_query("SELECT * FROM links WHERE id=$id LIMIT 1;"); // look for the specified link
$link = mysql_fetch_array($linkquery);

if(!$link)
die("<div id = 'error-box'>The specified page does not exists! please <a href = 'index.php'>click here</a><br />to go to the homepage.</div>");

// if the ID exists in the database, start the count process

$day = date("d");
$month = date("m");
$year = date("y");
$date = "$day/$month/$year";

$ip = $_SERVER["REMOTE_ADDR"]; 
$ids = 	$_GET['id'];  

$query = mysql_query("SELECT * FROM links_info WHERE ip='$ip' and id='$ids';");	

$lookvisitorsip = mysql_fetch_array($query); 

if(!$lookvisitorsip) // if the visitor's ip isn't already in the database add one more click  

mysql_query("UPDATE links SET clicks=(clicks+1) WHERE id=$id;"); // add 1 click to the specified id	

// if you just want to count clicks, without get members info delete this next line
mysql_query("INSERT INTO links_info (id,ip,date) VALUES ($id,'$ip','$date');") or die(mysql_error()); // save the area which your visitor went, their IP and the date when they visit it
header("Location: $link[ref]"); // redirect to the page//

?>

[madhead29]

Can nobody help me with this?

[scrupul0us]

i can give you some security advise:

$id = stripslashes($_GET['id']);

if(!$id)
exit; // if the link was not specified, stop runing

$id = stripslashes($id); // for security reasons

is poor at best...

heres a much safer implementation

if(isset($_GET['id']) and ctype_digit($_GET['id']))
{
//the ID is set and is guaranteed to only be numeric data
}

[madhead29]

Hi Thanks for that i will use it. Also im going to buy the security book thats in your sig to get better at security. Thanks again.

[scrupul0us]

its a good book to have... but really you can sum it up by thinking this way

any input that comes from a user (querystrings, forms,etc) are always considered dirty until you clean them and validate them...

check out the ctype reference to easily validate types of data... also check out the filter reference for using PHP's built in filters for sanitizing and validating input data

[madhead29]

Thanks for the information I have bookmarked the links so I can use them in the furture. Thanks again.