Sr. Web Developer
mediabistro.com
US-NY-New York

Justtechjobs.com Post A Job | Post A Resume

Comments for: tim20001211

Message # 1007830:
Date: 10/18/01 12:03
By: Anders Kronquist
Subject: Problem using 1x1 pixel GIF image

There is an additional problem if you use a GIF image - the image does not have to be loaded (I don't think you'd ever see Lynx as a browser). Because of this, you get more reliable data by making the webserver send the data to the script instead of the user. This can be done by issuing a GET/POST command to one of the log servers pages. This will impact the webservers performance, however, which may be a Bad Thing (tm).

The good thing about using the image approach is that it is the web browser (client) that does the work for you - but this also means that since the browser does not have to follow every IMG link you may never be totally sure of your data.
As a matter of fact, with the use of such proxy programs as Proxomitron you can quite easily remove any external IMG links (links that does not lead to the current browser). There is also the possibility of malicious use of the link, passing erroneous and possibly malicious ("&g='; DROP DATABASE <bruteforce database names>") content to the script (by creating a page with 10 000 IMG links to your GIF image (thereby providing an excellent way to bruteforce database and table names. Most people tend to use simple names for their tables.

Lastly, there is the problem of user anonymity - does your user want to be logged? Is it OK to check the users referrer? And since the information provided by the browser can be a 'lie', should we trust the browsers information enough to log it, thereby implying that, 'ShonenScape', 'Macrosoft Exploder' and 'Netquake' has been used in 3% of all access to our webpages?

Previous Message | Next Message


Comments:
RE: opentrackerMayukh04/30/05 05:46
RE: Some fixes to SourceForges browser.phpDavid Neff12/06/02 20:29
Cache Problem(On Indirect Ip's)Shrirang Kulkarni11/06/02 03:43
Some fixes to SourceForges browser.phpmorten hansen10/29/02 09:49
RE: Referrer checking?tony06/28/02 23:32
Use timestamp from random numnicole05/16/02 16:50
RE: Sample SQL to run reports sortingChris Peterson04/22/02 04:14
RE: Sample SQL to run reports sortingBrandon04/05/02 18:19
Sample SQL to run reports sortingLuis Oliveira03/25/02 04:48
Problem using 1x1 pixel GIF imageAnders Kronquist10/18/01 12:03
Referrer, uniques and standardsFrans03/08/01 19:46
Memory effective DatabaseKenneth02/08/01 12:21
RE: Apache log => mysqlMartin01/16/01 06:16
Java referrerdavid01/01/01 20:35
here's some code I use on a large systemStephen VanDyke12/28/00 14:45
RE: Referrer checking?david12/27/00 20:55
RE: A more optimized solutionRichard Bendelow12/22/00 08:41
RE: Badly normalized - Both?llong12/20/00 18:36
RE: opentrackerllong12/20/00 18:21
Error but no error echoed???Charles12/19/00 15:36
Apache log => mysqlJames12/19/00 10:05
RE: Badly normalizedJeppe Salvesen12/15/00 20:12
Simple way to convert Day integer back to datPatrick12/14/00 21:27
mod_log_mysql is the way to goNathan Cassano12/14/00 11:54
!the real solution: webalizer.com/sample !!!Igor12/13/00 13:40
RE: Badly normalizedBeth J.12/13/00 11:08
RE: Disabled imagesTim Perdue, PHPBuilder.com12/13/00 10:32
Disabled imagesJoe Clarke12/12/00 19:47
A more optimized solutionStallion12/12/00 14:57
RE: Real user trackingEd Rahn12/12/00 14:20
RE: Not the fastest solutionViking12/12/00 11:37
RE: Badly normalizedMartijn12/12/00 11:29
opentrackeredmz12/12/00 11:12
RE: Referrer checking?Martin Joergensen12/12/00 10:25
RE: Badly normalizedTim Perdue, PHPBuilder.com12/12/00 09:44
Another alternativeGeorge Schlossnagle12/12/00 08:58
RE: Referrer checking?Grant Petersen12/12/00 01:54
RE: Not the fastest solutionHendrik Mans12/11/00 20:13
Badly normalizedJeppe Salvesen12/11/00 19:04
HTML-based e-mailChris Thompson12/11/00 17:42
Not the fastest solutionViking12/11/00 16:08
RE: Real user trackingSean Clark12/11/00 14:07
RE: Real user trackingluke chasteen12/11/00 12:53
RE: Referrer checking?Pavel Prishivalko12/11/00 10:55
RE: Referrer checking?Micheal O Shea12/11/00 09:33
RE: Real user trackingTim Perdue, PHPBuilder.com12/11/00 09:30
RE: Referrer checking?John12/11/00 08:24
Real user trackingNightOwl12/11/00 07:38
cache problem if using host without PHPSaS12/11/00 07:08
RE: Referrer vs. Referer foophilip olson12/10/00 21:59
RE: Referrer checking?Tim Perdue, PHPBuilder.com12/10/00 21:30
Referrer checking?Hendrik Mans12/10/00 20:44
 

If you are looking for help, please post on the appropriate forum here. Your questions will be answered much more quickly.

Add A Comment:

Name:

Email:

Subject:

Message:

To reduce spam posts, messages are now manually approved

You are not [logged in]. That means your account will not get credit for this post.