Clickbank Security Using PHP

by: Robert Plank

Here's a way to protect the products you sell with Clickbank, using their built-in protection and by implementing a 30-day expiration, all without having to worry about managing databases or customer lists.

THE FIRST STEP

First of all, Clickbank protection is decent as it is. If you want to keep your customers from passing the thank you page URL around to friends, there are a couple of things you can do.

Login to your Clickbank account: http://www.clickbank.com/login.html

At the top there's a link that says "Click HERE to modify your account". Click on the link.

On this page there are two links at the top, but one says "Click HERE to modify your account." Click on this one.

You should be at the page that allows you to edit the prices of all your Clickbank products. Scroll down to the bottom where it says:

Secret key (up to 16 letters & digits)

You should see a text box here. If it's empty, choose a secret key, type it in and remember it. It can be anything you want, but it should be different than your Clickbank password.

"COOKIE CUTTER" TOOLS

If you've looked around the Clickbank site you'd know that Clickbank offers some friendly pieces of code in a few different programming languages like Perl and PHP that can help you protect your downloads. Basically this is what happens:

* Your order link contains what's called a "seed". This is just a word or a piece of text, which can be anything you want.

* Your customer clicks on the order link and pays.

* Clickbank takes that seed, and uses your secret key on it -- basically mashes the two together and does a bunch of crazy stuff to come up with a garbled piece of junk. But this a garbled piece of junk that can ONLY come from this seed and secret key. You change the value of the seed or secret key even a little and this "hash" changes.

* The seed and the hash are passed back to the thank you page where your Clickbank script sits. (We have the secret key added to your script, and it never changes, so it doesn't need to be handed to us by Clickbank.) This Clickbank script takes the seed and the secret key and does the same crazy shit Clickbank did to us to compute your own hash.

Clickbank calls this their "cbpop" or Clickbank Proof of Purchase.

The hash was something we figured out on your own and the hash Clickbank are compared. If they match, we're in business because the customer here really did buy from us.. The customer can't figure this out on his or her own because they never actually saw the secret key. (And no, you can't "reverse" a hash to figure out the original secret key.)

If you get nothing out of what I just told you, remember this: it's almost impossible for anyone to figure out the right Proof of Purchase code without that secret key.

USING SOMEONE ELSE'S CODE

This is the PHP function they give us:

function cbValid($seed, $cbpop, $secret_key) {

// A bunch of stuff in here...

}

This function cbValid takes three parameters: $seed, $cbpop, and $secret_key. The script goes through that last step of ours I explained above, does the crazy shit and then compares the result to the one given to us by Clickbank.

Now we need to figure out what to do if your customer really didn't pay. The easiest thing to do, is just stop the script in its tracks, preventing the page under it from loading.

if (!cbValid($seed, $cbpop, $secret_key)) die();

The exclamation point means "not". We're saying, first try this...

cbValid($seed, $cbpop, $secret_key)

.. pass the seed, proof of purchase, and secret key into your black box. If the function tells us NO, do the rest. In this case, "die". Die stops everything immediately, so if you have HTML or PHP code below that line, it won't be looked at if the Clickbank validation fails.

The "proper" way to grab $seed from the query string is this way:

if (!cbValid($_GET["seed"], $_GET["cbpop"], $secret_key)) die();

You could also redirect the user to an error page of yours if you like:

if (!cbValid($_GET["seed"], $_GET["cbpop"], $secret_key)) {

header("Location:http://www.your.host/error.html");

die();

}

Instead of $seed and $cbpop we use $_GET["seed"] and $_GET["cbpop"]. This is because the variables don't appear magically out of thin air, they really appear in the URL as http://www.your.url/test.php?seed=SOMESEED&cbpop=SOMEPOP. We want these values to be taken out of the URL.

USE MINE

Here's a zip file containing your cb.php script: http://www.jumpx.com/tutorials/clickbank/cb.zip

Save it, unzip it, and open cb.php. Near the top should be a line such as:

$secret_key = "YOUR_SECRET_KEY";

Change YOUR_SECRET_KEY to that secret key you set in the Clickbank control panel.

Now, for usage... your thank you pages will have to end in .php here. Like, thankyou.php (and now it doesn't matter if they have obvious names or not -- because they'll be thoroughly inaccessible to thieves. Remember, you can simply rename your HTML pages so they end in .php and they'll still work just fine.

Put this line at the top of you thank you page script:

Be sure to upload cb.php to the same folder as your thank you page. Now, when someone goes to the thank you page, the first thing the thank you script will do is run everything in cb.php, and cb.php will take the data Clickbank has passed to see if it matches.

You're going to have to change your Clickbank order links a little. This is what they should look like now:

http://www.clickbank.net/sell.cgi?link=YOUR_CLICKBANK_ID/YOUR_PRODUCT_ID/

YOUR_PRODUCT_NAME&seed=YOUR_SEED

Replace YOUR_CLICKBANK_ID with, of course, your Clickbank ID and YOUR_SEED with the seed you want to use. This can be anything, something simple that's short and one word like the product name. But NOT your secret key.

YOUR_PRODUCT_ID is the number Clickbank shows to the left of each thank you page as you add it. When you're testing, be sure to set the price at $0.00. Once everything's in place you can raise the price of the item to $19.95 or $29.95 or whatever it's priced at.

http://www.clickbankguide.com/merchant.htm#account will explain everything if you're a Clickbank newbie.

COULDN'T THE DOWNLOAD URL, HASH, AND RECEIPT BE SHARED?

You can't prevent sharing completely... after all, your customer can always download the file and share the file, not the download URL, to friends. We can do one thing to give these would-be freeloaders a bit of a headache, and that is expiration.

Here we can say, 30 days after someone buys your product, the thank you page will be inaccessible to them. If they buy on October 25th, they can bookmark and revisit that thank you page up until November 25th at the exact time they made their purchase. It's kind of a nice compromise because it gives honest people enough time to get what they need but at the same time it becomes impractical to share the URL.

In chapter 9 of my book, Simple PHP (http://www.simplephp.com), I explained how time works on computers, they use a big number which is just a count of how many seconds have passed since January 1st, 1970. I also explained that there was a function, called strtotime(), which we could use to determine this "number" or timestamp of a certain date. For example, 30 days ago or 1 year ago.

30 days sounds about right. To figure out the Unix timestamp of this moment, minus 30 days is:

strtotime("-30 days")

Now, to store it in a variable called $expire:

$expire = strtotime("-30 days");

But you're saying, how do I know when these people purchased? I don't have that kind of information. Aha! But you can. Remember, the seed you put in your order links can be anything you want. So let's just make it the timestamp of this exact moment.

When the customer revisits the thank you page, they can't change the seed, because as I mentioned, if you change *either* the seed or the secret key, the resulting hash (proof of purchase) will be different. So you see, they're stuck with it. But, the current time always changes!

All we have to do, in cb.php, are these two steps:

* Figure out what the timestamp was exactly 30 days ago, and store this value in $expire.

* Compare the seed and $expire. If the the value of the seed is less than that of $expire, it means that the product was purchased more than 30 days ago and the visitor shouldn't be given access to the page. Die.

We've already taken care of step one by saving the timestamp 30 days prior in $expire. Now, we compare the seed (it's $_GET["seed"], remember, because we're grabbing it out of the URL string) and $expire like:

if ($_GET["seed"] Order Now

Instead of YOUR_SEED we want PHP to call the function mktime(), which gives us the current timestamp, and output it, using echo.

echo mktime();

Now just put around it...

And shove it in there.

">Order Now

Now setup a link for $0.00 in your Clickbank control panel and try it. You can be sure it works by changing that "-30 days" in strtotime to "-5 minutes". Then try accessing the download page, then wait 5 minutes and try again. Neat, isn't it?

You say, I've done this, but I have more than one product. How do I keep someone from grabbing everything once they've grabbed one?

Have your links look like the following: ">Order Now

This way the seeds will look like "stringbeans445433" if you're selling stringbeans. Then again if you're selling corn on the cob on another sales page, you can change "stringbeans" to "cornonthecob". Now the seeds for each product will be different.

Those seeds won't be all numbers, will they? So, in cb.php, do this:

$timestamp = ereg_replace("[^0-9]","",$_GET["seed");

I won't go into a lot of detail about pattern matching, but the [^0-9] means "NOT anything from 0 to 9. It basically goes through every letter and number of $_GET["seed"], and if what's there isn't a 0, 1, 2, etc. it's replaced with nothing (hence the ""). The final result is saved in a variable called $timestamp.

Since now we're looking at $timestamp and not $_GET["seed"], let's change that if-statement:

if ($timestamp

When I extracted the timestamp from the seed, I simply removed all characters that were not numbers, leaving just the numbers contained within that string. Now I want to do the opposite. Here's an example seed:

test1074482258

I take out all the numbers and am left with "test". Next I figure out which script called cb.php (which is stored in the variable $_SERVER["SCRIPT_NAME"]). Then the script takes out everything up to the last slash (/) and everything before the first dot (.). If the script was located at "/clickbank/test.php", all that's left is "test".

If you give each thank you page a different name, and make sure all your seeds reflect the correct page, i.e. if your thank you page is called "carrots", the part of that order link containing the seed should appear as:

&seed=carrots

If you don't care how Clickbank's protection works, that's your derogative. Just get the zip file and follow the instructions I've provided in cb.php.

As far as scripts that handle several Clickbank products -- I can't recommend any at this time, since I've never across any good ones. (But you should check out Harvey Segal's free site, ClickbankGuide.com, which can answer most of your questions about Clickbank.)

Here's that script again in case you missed it: http://www.jumpx.com/tutorials/clickbank/cb.zip

Make sure to read the instructions I've supplied in cb.php, get everything setup and on your web server, and you'll be well on your way to having bulletproof protection on your Clickbank products.

MySQL Database Handling in PHP

by: John L

Most interactive websites nowadays require data to be presented dynamically and interactively based on input from the user. For example, a customer may need to log into a retail website to check his purchasing history. In this instance, the website would have stored two types of data in order for the customer to perform the check – the customer’s personal login details; and the customer’s purchased items. This data can be stored in two types of storage – flat files or databases.

Flat files are only feasible in very low to low volume websites as flat files have 3 inherent weaknesses:

1. The inability to index the data. This makes it necessary to potentially read ALL the data sequentially. This is a major problem if there are a lot of records in the flat file because the time required to read the flat file is proportionate to the number of records in the flat file.
2. The inability to efficiently control access by users to the data
3. The inefficient storage of the data. In most cases, the data would not be encrypted or compressed as this would exacerbate the problem no. 1 above

The alternative which is, in my opinion, the only feasible method, is to store the data in a database. One of the most prevalent databases in use is MySQL. Data that is stored in a database can easily be indexed, managed and stored efficiently. Besides that, most databases also provide a suite of accompanying utilities that allow the database administrator to maintain the database – for example, backup and restore, etc.

Websites scripted using PHP are very well suited for the MySQL database as PHP has a custom and integrated MySQL module that communicates very efficiently with MySQL. PHP can also communicate with MySQL through the standard ODBC as MySQL is ODBC-compliant, However, this will not be as efficient as using the custom MySQL module for PHP.

The rest of this article is a tutorial on how to use PHP to:

1. Connect to a MySQL database
2. Execute standard SQL statements against the MySQL database

Starting a Session with MySQL

Before the PHP script can communicate with the database to query, insert or update the database, the PHP script will first need to connect to the MySQL server and specify which database in the MySQL server to operate on.

The mysql_connect() and mysql_select_db() functions are provided for this purpose. In order
to connect to the MySQL server, the server name/address; a username; and a valid password is required. Once a connection is successful, the database needs to be specified.

The following 2 code excerpts illustrate how to perform the server connection and database selection:

@mysql_connect("[servername]", "[username]", "[password]") or die("Cannot connect to DB!");

@mysql_select_db("[databasename]") or die("Cannot select DB!");

The @ operator is used to suppress any error messages that mysql_connect() and mysql_select_db() functions may produce if an error occurred. The die() function is used to end the script execution and display a custom error message.

Executing SQL Statements against a MySQL database

Once the connection and database selection is successfully performed, the PHP script can now proceed to operate on the database using standard SQL statements. The mysql_query() function is used for executing standard SQL statements against the database. In the following example, the PHP script queries a table called tbl_login in the previously selected database to determine if a username/password pair provided by the user is valid.

Assumption:

The tbl_login table has 3 columns named login, password, last_logged_in. The last_logged_in column stores the time that the user last logged into the system.

// The $username and $passwd variable should rightly be set by the login form
// through the POST method. For the purpose of this example, we’re manually coding
it.

$username = “john”;
$passwd = “mypassword”;

// We generate a SELECT SQL statement for execution.
$sql="SELECT * FROM tbl_login WHERE login = '".$username."' AND password =
'".$passwd."'";

// Execute the SQL statement against the currently selected database.
// The results will be stored in the $r variable.
$r = mysql_query($sql);

// After the mysql_query() command executes, the $r variable is examined to
// determine of the mysql_query() was successfully executed.
if(!$r) {
    $err=mysql_error();
    print $err;
    exit();
}

// If everything went well, check if the query returned a result – i.e. if the
username/password
// pair was found in the database. The mysql_affected_rows() function is used for this
purpose.
// mysql_affected_rows() will return the number of rows in the database table that was
affected
// by the last query
if(mysql_affected_rows()==0){
    print "Username/password pair is invalid. Please try again.";
}
else {

// If successful, read out the last logged in time into a $last variable for display
to the user
    $row=mysql_fetch_array($r);
    $last=$row["last_logged_in"];
    print “Login successful. You last logged in at ”.$last.”.”;

}

The above example demonstrated how a SELECT SQL statement is executed against the selected database. The same method is used to execute other SQL statements (e.g. UPDATE, INSERT, DELETE, etc.) against the database using the mysql_query() and mysql_affected_rows() functions.

Track Your Visitors, Using PHP

by: Dennis Pallett

There are many different traffic analysis tools, ranging from simple counters to complete traffic analyzers. Although there are some free ones, most of them come with a price tag. Why not do it yourself? With PHP, you can easily create a log file within minutes. In this article I will show you how!

Getting the information

The most important part is getting the information from your visitor. Thankfully, this is extremely easy to do in PHP (or any other scripting language for that matter). PHP has a special global variable called $_SERVER which contains several environment variables, including information about your visitor. To get all the information you want, simply use the following code:

// Getting the information
$ipaddress = $_SERVER['REMOTE_ADDR'];
$page = "http://{$_SERVER['HTTP_HOST']}{$_SERVER['PHP_SELF']}";
$page .= iif(!empty($_SERVER['QUERY_STRING']), "?{$_SERVER['QUERY_STRING']}", "");
$referrer = $_SERVER['HTTP_REFERER'];
$datetime = mktime();
$useragent = $_SERVER['HTTP_USER_AGENT'];
$remotehost = @getHostByAddr($ipaddress);

As you can see the majority of information comes from the $_SERVER variable. The mktime() (http://nl2.php.net/mktime) and getHostByAddr() (http://nl2.php.net/manual/en/function.gethostbyaddr.php) functions are used to get additional information about the visitor.

Note: I used a function in the above example called iif(). You can get this function at http://www.phpit.net/code/iif-function.

Logging the information

Now that you have all the information you need, it must be written to a log file so you can later look at it, and create useful graphs and charts. To do this you need a few simple PHP function, like fopen (http://www.php.net/fopen) and fwrite (http://www.php.net/fwrite).

The below code will first create a complete line out of all the information. Then it will open the log file in "Append" mode, and if it doesn't exist yet, create it.

If no errors have occurred, it will write the new logline to the log file, at the bottom, and finally close the log file again.

// Create log line
$logline = $ipaddress . '|' . $referrer . '|' . $datetime . '|' . $useragent . '|' 
. $remotehost . '|' . $page . "\n";

// Write to log file:
$logfile = '/some/path/to/your/logfile.txt';

// Open the log file in "Append" mode
if (!$handle = fopen($logfile, 'a+')) {
 die("Failed to open log file");
}

// Write $logline to our logfile.
if (fwrite($handle, $logline) === FALSE) {
 die("Failed to write to log file");
}

fclose($handle);

Now you've got a fully function logging module. To start tracking visitors on your website simply include the logging module into your pages with the include() function (http://www.php.net/include):

include ('log.php');

Okay, now I want to view my log file

After a while you'll probably want to view your log file. You can easily do so by simply using a standard text editor (like Notepad on Windows) to open the log file, but this is far from desired, because it's in a hard-to-read format.

Let's use PHP to generate useful overviews for is. The first thing that needs to be done is get the contents from the log file in a variable, like so:

// Open log file
$logfile = "/some/path/to/your/logfile.txt";

if (file_exists($logfile)) {
 
 $handle = fopen($logfile, "r");
 $log = fread($handle, filesize($logfile));
 fclose($handle);
} else {
 die ("The log file doesn't exist!");
}

Now that the log file is in a variable, it's best if each logline is in a separate variable. We can do this using the explode() function (http://www.php.net/explode), like so:

// Seperate each logline
$log = explode("\n", trim($log));

After that it may be useful to get each part of each logline in a separate variable. This can be done by looping through each logline, and using explode again:

// Seperate each part in each logline
for ($i = 0; $i <> 
Now the complete log file has been parsed, and we're ready to start generating some interesting stuff. 
The first thing that is very easy to do is getting the number of pageviews. Simply use count() (http://www.phpit.net/count) on the $log array, and there you have it; 
echo count($log) . " people have visited this website.";
You can also use custom functions to filter out search engines and crawlers. Or create graphs using PHP/SWF Charts (http://www.maani.us/charts/index.php). The possibilities are endless, and you can do all kinds of things! 
In Conclusion... 
In this article I have shown you have to create a logging module for your own PHP website, using nothing more than PHP and its built-in functions. To view the log file you need to parse it using PHP, and then display it in whatever way you like. It is up to you to create a kick-ass traffic analyzer. 
If you still prefer to use a pre-built traffic analyzer, have a look at http://www.hotscripts.com.   

AJAX Tutorial 1 - Introduction Video

This is example video that i embedded from youtube.com which is show about AJAX. Enjoy learn AJAX.