Good points. I guess I should have mentioned more about security of each method.

REMOTE_ADDR and REMOTE_HOST are pretty safe since they come from the sockaddr struct that relates to the connection, so you are somewhat succeptible to a man-in-the-middle attack if the sender can spoof the IP address and catch the return packets (assuming that there is no TCP sequence number bug that allows him to predict the excact set of packets to send from elsewhere). Of course you are succeptible to a DNS attack if the attacker can spoof the reverse IP address lookup, and DNS is notoriously unsafe.

Storing the ID on each page is relatively safe iff (sic) the discount ID refers to a token ID stored in the DB that is generated randomly (assuming your random number generator is sufficiently random) from a large search space. Really cookies and hidden form variables are equivalent since they are both submitted on each request and the user can munge them both. Since this is discounts you have to decide if you want the user to log in to the site.

Personally I despise logging in until I am actually ready to order. It might be more productive for a site to give a 5% discount to a handful more people if they get more sales in general. Remember that stores often see 30 - 60% markups so they are making a profit even if they offer substantial discounts.

-ben

In reply to Re: Re: Re: Changing website prices based on client? (keywd: Web Software Engr) by knobunc
in thread Changing website prices based on client? (keywd: Web Software Engr) by princepawn

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.