Continued from page 1
Here we can say, 30 days after someone buys your product, thank you page will be inaccessible to them. If they buy on October 25th, they can bookmark and revisit that thank you page up until November 25th at exact time they made their purchase. It's kind of a nice compromise because it gives honest people enough time to get what they need but at same time it becomes impractical to share URL.
In chapter 9 of my book, Simple PHP (http://www.simplephp.com), I explained how time works on computers, they use a big number which is just a count of how many seconds have passed since January 1st, 1970. I also explained that there was a function, called strtotime(), which we could use to determine this "number" or timestamp of a certain date. For example, 30 days ago or 1 year ago.
30 days sounds about right. To figure out Unix timestamp of this moment, minus 30 days is:
strtotime("-30 days")
Now, to store it in a variable called $expire:
$expire = strtotime("-30 days");
But you're saying, how do I know when these people purchased? I don't have that kind of information. Aha! But you can. Remember, seed you put in your order links can be anything you want. So let's just make it timestamp of this exact moment.
When customer revisits thank you page, they can't change seed, because as I mentioned, if you change *either* seed or secret key, resulting hash (proof of purchase) will be different. So you see, they're stuck with it. But, current time always changes!
All we have to do, in cb.php, are these two steps:
* Figure out what timestamp was exactly 30 days ago, and store this value in $expire.
* Compare seed and $expire. If the value of seed is less than that of $expire, it means that product was purchased more than 30 days ago and visitor shouldn't be given access to page. Die.
We've already taken care of step one by saving timestamp 30 days prior in $expire. Now, we compare seed (it's $_GET["seed"], remember, because we're grabbing it out of URL string) and $expire like:
if ($_GET["seed"] < $expire)
And finally plug it into if-statement before that checked hashes:
if ($_GET["seed"] < $expire or !cbValid($_GET["seed"], $_GET["cbpop"], $secret_key)) die();
We've got that part taken care of, now for home stretch. We've got to actually get those seeds to be current time. How do we do that? Again, pages containing your order link will have to be renamed to end in ".php". Hey, you're one who wants to prevent theft.
Let's pretend this is a Clickbank link:
Order Now
Instead of YOUR_SEED we want PHP to call function mktime(), which gives us current timestamp, and output it, using echo.
echo mktime();
Now just put around it...
And shove it in there.
Order Now
Now setup a link for $0.00 in your Clickbank control panel and try it. You can be sure it works by changing that "-30 days" in strtotime to "-5 minutes". Then try accessing download page, then wait 5 minutes and try again. Neat, isn't it?
You say, I've done this, but I have more than one product. How do I keep someone from grabbing everything once they've grabbed one?
Have your links look like following: Order Now
This way seeds will look like "stringbeans445433" if you're selling stringbeans. Then again if you're selling corn on cob on another sales page, you can change "stringbeans" to "cornonthecob". Now seeds for each product will be different.
Those seeds won't be all numbers, will they? So, in cb.php, do this:
$timestamp = ereg_replace("[^0-9]","",$_GET["seed");
I won't go into a lot of detail about pattern matching, but [^0-9] means "NOT anything from 0 to 9. It basically goes through every letter and number of $_GET["seed"], and if what's there isn't a 0, 1, 2, etc. it's replaced with nothing (hence ""). The final result is saved in a variable called $timestamp.
Since now we're looking at $timestamp and not $_GET["seed"], let's change that if-statement:
if ($timestamp < $expire or !cbValid($_GET["seed"], $_GET["cbpop"], $secret_key)) die();
Now it checks with $timestamp instead of $_GET["seed"].
One last thing I implemented in here was a little something that keeps a customer from paying for one of your products, and getting access to rest. Look at this part of that order link I gave you:
&seed=thankyou
When I extracted timestamp from seed, I simply removed all characters that were not numbers, leaving just numbers contained within that string. Now I want to do opposite. Here's an example seed:
test1074482258
I take out all numbers and am left with "test". Next I figure out which script called cb.php (which is stored in variable $_SERVER["SCRIPT_NAME"]). Then script takes out everything up to last slash (/) and everything before first dot (.). If script was located at "/clickbank est.php", all that's left is "test".
If you give each thank you page a different name, and make sure all your seeds reflect correct page, i.e. if your thank you page is called "carrots", part of that order link containing seed should appear as:
&seed=carrots
If you don't care how Clickbank's protection works, that's your derogative. Just get zip file and follow instructions I've provided in cb.php.
As far as scripts that handle several Clickbank products -- I can't recommend any at this time, since I've never across any good ones. (But you should check out Harvey Segal's free site, ClickbankGuide.com, which can answer most of your questions about Clickbank.)
Here's that script again in case you missed it: http://www.jumpx.com utorials/clickbank/cb.zip
Make sure to read instructions I've supplied in cb.php, get everything setup and on your web server, and you'll be well on your way to having bulletproof protection on your Clickbank products.
Robert Plank is the creator of Lightning Track, Redirect Pro, Rotatorblaze, and other useful tools.
Want to pick up more programming skills? Then purchase the e-book "Simple PHP" at http://www.simplephp.com
You may reprint this article in full in your newsletter or web site.