[PHP] Basic Referral System

Hey,

This is a basic referral system i typed up while in school, It roughly took 15 mins. So here goes.
We start off with the database structure:
Code:
CREATE TABLE `referral` (
`id` int(11) NOT NULL auto_increment,
`URL` varchar(255) NOT NULL default '',
`hits` varchar(255) NOT NULL default '',
PRIMARY KEY (`id`)
) TYPE=MyISAM;
The next part is the actual file to log the clicks. referral.php:
PHP Code:
<?
$connect = mysql_connect("localhost","DATABASE USERNAME","DATABASE PASSWORD");
mysql_select_db(DATABASE NAME) or die(mysql_error());
$URL = $_POST[url];
$check = mysql_query("SELECT * FROM referral WHERE URL='$URL'");
$data = mysql_fetch_array($check);
$check = mysql_num_rows($check);
if($check>0)
{
echo("Error. Refferal URL/ID is invalid.");
exit();
}
$hits = $data[hits]++;
$update = mysql_query("Update referral set hits = '$hits' where id = '$data[id]'");
echo ("<meta http-equiv=\"Refresh\" content=\"0; URL=http://$URL\"/>Thank You! You will be redirected to $URL");
?>
PHP Code:
$connect = mysql_connect("localhost","DATABASE USERNAME","DATABASE PASSWORD");
mysql_select_db(DATABASE NAME) or die(mysql_error()); 
The above code defines the database we intend to connect to. This will be the database you put the above mySQL database structure into.

PHP Code:
$URL = $_POST[url];
$check = mysql_query("SELECT * FROM referral WHERE URL='$URL'");
$data = mysql_fetch_array($check);
$check = mysql_num_rows($check); 
The first line of this catches the name of the link that has been clicked so any links will always be like refferal.php?URL=thesitename.com.
The next few lines are different check functions to gather information from the database to declare if the URL is vaild.

PHP Code:
if($check>0)
{
echo("Error. Refferal URL/ID is invalid.");
exit();
} 
This part will check if there is a row in the database that is the same as the URL gathered by the URL variable. If there is no row like this an error message will appear.

PHP Code:
$hits = $data[hits]++;
$update = mysql_query("Update referral set hits = '$hits' where id = '$data[id]'");
echo ("<meta http-equiv=\"Refresh\" content=\"0; URL=http://$URL\"/>Thank You! You will be redirected to $URL"); 
The first line collects the current number in the database and then adds +1 onto it and then the next line saves the new number in the database. The last line will then finally redirect the person to the website.

Inportant Notes

• All url's wising to be counted must start like so referral.php?URL=
• You must use PHPmyadmin to enter the links to be counted or another mySQL database manager.
  

Hope this helps, Adam

Nice TUT! +rep.

i like this alot!

Very insecure.

Great tut but..

Matt Wrote:Very insecure.

I do agree with Matt. At least wrap your post fields with mysql_real_escape_string or addslashes. You may also want to start using full php tags (<?php ?>

PHP Code:
<? ?> will be deprecated in php 6, as well as magic quotes.

Other than that, great tut! +Rep

It's a nice try, but i think you can do things very better, like this:

- Always secure your $_POST and $_GET vars.
- Always put variables out of a query.
- You do 2 querys in what you can do in a simple time.

Like:
PHP Code:
$check = mysql_query("SELECT * FROM referral WHERE url='".$URL."' "); 
$data = mysql_fetch_array($check); 

if(mysql_num_rows($check) >0) 
{ 
echo("Error. Refferal URL/ID is invalid."); 

} 

You can do that like:
(Do not place exit, it looks like a crime game.) If you use else{, it has the same event..
Try to use HIGH LETTERS in staid of little letters, for the query statements (LIKE, WHERE, AND, OR, SELECT, DELETE, etc..)
PHP Code:
$check = mysql_query("SELECT * FROM referral WHERE URL='".$URL."' "); 
$data = mysql_fetch_array($check); 

if(mysql_num_rows($check) >0) 
{ 
echo("Error. Refferal URL/ID is invalid."); 

}
else
{
$hits = $data[hits]++; 
$update = mysql_query("UPDATE referral SET hits = '".$hits."' WHERE id = '".$data[id]."' "); 
echo ("<meta http-equiv=\"Refresh\" content=\"0; URL=http://".$URL.">Thank You! You will be redirected to '.$URL); 
} 

The rest of the code i do another time. But i try to help you and not to blame you.

$URL = $_POST[url];

to $URL = $_POST['url'];

also add stripslashes to the $_POST.

thanks