A couple of things:
  1. REMOTE_ADDR and REMOTE_HOST can be modified by the user. There is no guarantee that the value transmitted for these variables is correct. Therefor, these can be abused by someone attempting to gain improper discounts.
  2. Storing an ID as a hidden on a page again leaves you open for abuse. This relates strongly to the recent rash of poorly written shopping cart systems being abused. The prices were being "hidden" in the HTML, all a would be abuser needed to do was: Save the HTML, change the price, hit the button -- Wallah! Pay $1.00 for a $100.00 item. Storing an ID for discount could be similarly abused.
  3. Storing ID in a cookie, should be combined with sessioning to help avoid abuse. If the cookie value is indexed in such a way that it is only good for a period of time, the chance for abuse is limited. Possibly linked to IP or other identifying information as well, to make transference of the cookie ID to a different machine more problematic. This type of solution will probably lead you to have to "re-authenticate" the user periodically based on some business rules regarding latentcy and/or total visit time.
Please do not fall into the trap of believing a piece of sensitive data in a "HIDDEN" form field is secure or tamper-proof -- it simply is not, and has been abused significantly, regularly, and recently.

In reply to Re: Re: Changing website prices based on client? (keywd: Web Software Engr) by Sifmole
in thread Changing website prices based on client? (keywd: Web Software Engr) by princepawn

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.