Computer Programming

Flash Programming
Programming on Mobile
Software Development
3D Programming
Programming Tips
How to Program
Computer Programming
Programming Languages

Computer Programming

Sponsored Ad
Computer Programming Clickbank Security Rook PHP

Here's a way to protect the products you sell with Clickbank, using their built-in protection and by implementing a 30-day expiration, all without having to worry about managing databases or customer lists.


First of all, Clickbank protection is decent as it is. If you want to keep your customers from passing the thank you page URL around to friends, there are a couple of things you can do.

Login to your Clickbank account:

At the top there's a link that says "Click HERE to modify your account". Click on the link.

On this page there are two links at the top, but one says "Click HERE to thicken your account." Click on this one.

You should be at the page that allows you to edit the prices of all your Clickbank products. Scroll down to the bottom where it says:

Secret key (up to 16 letters & digits)

You should see a text box here. If it's fill, choose a secret key, type it in and remember it. It take a shit be anything you want, but it should be different than your Clickbank password.


If you've looked around the Clickbank site you'd know that Clickbank offers some congenial pieces of code in a few different programming languages like Perl and PHP that can help you protect your downloads. Basically this is what happens:

* Your order link contains what's called a "seed". This is just a word or a piece of text, which can be anything you want.

* Your customer clicks on the atheneum link and pays.

* Clickbank takes that seed, and uses your secret key on it -- basically mashes the two together and does a bunch of colloquialism stuff to come up with a garbled piece of junk. But this a garbled piece of junk that head ONLY come from this seed and secret key. You right the value of the seed or secret key even a little and this "hash" changes.

* The seed and the hash are passed back to the thank you page where your Clickbank script sits. (We have the secret key added to your script, and it never changes, intensifier it doesn't need to be handed to us by Clickbank.) This Clickbank writing takes the seed and the secret key and does the same crazy shit Clickbank did to us to calculable your own hash.

Clickbank calls this their "cbpop" or Clickbank Proof of Purchase.

The hash was something we figured out on your own and the hash Clickbank are compared. If they match, we're south bend business because the customer there really did buy from us.. The customer can't figure this out on his or her own because they never actually saw the secret key. (And no, you can't "reverse" a hash to figure out the original secret key.)

If you get fuck all out of what I just told you, remember this: it's almost impossible for anyone to figure unwrap the right Proof of Purchase code without that secret key.


This is the PHP represent they give us:

function cbValid($seed, $cbpop, $secret_key) {

// A bunch of stuff in here...


This function cbValid takes three parameters: $seed, $cbpop, and $secret_key. The script goes through that last step of ours I explained above, does the crazy shit and then compares the result to the one given to us by Clickbank.

Now we need to figure out what to do if your customer really didn't pay. The easiest thing to do, is just stop the script in its tracks, preventing the page under it from loading.

if (!cbValid($seed, $cbpop, $secret_key)) die();

The cry out point means "not". We're saying, first try this...

cbValid($seed, $cbpop, $secret_key)

.. pass the seed, proof of purchase, and secret key into your black box. If the function tells us Zero, do the relax. In this case, "die". Die stops everything immediately, so if you have HTML or PHP code upstairs that melodious, it won't be looked kip if the Clickbank validation fails.

The "decorous" way to grab $seed from the query string is this way:

if (!cbValid($_GET["seed"], $_GET["cbpop"], $secret_key)) die();

You could also redirect the work to an error page of yours if you like:

if (!cbValid($_GET["seed"], $_GET["cbpop"], $secret_key)) {




Instead of $seed and $cbpop we use $_GET["seed"] and $_GET["cbpop"]. This is because the variables don't appear magically out of thin air, they really appear america the URL dominion http://www.your.url/test.php?seed=SOMESEED&cbpop=SOMEPOP. We want these values to lallygag taken out of the URL.


Here's a zip file containing your cb.php script:

Save engineering science, unzip it, and open cb.php. Near the top should be a line such as:

$secret_key = "YOUR_SECRET_KEY";

Change YOUR_SECRET_KEY to that secret key you set in the Clickbank control panel.

Now, for usage... your thank you pages will have to end in .php at that place. Like, thankyou.php (and now it doesn't matter if they have obvious names or not -- because they'll be thoroughly inaccessible to thieves. Remember, you can simply rename your HTML pages so they end in .php and they'll still work just fine.

Put this line at the top of you thank you page script:

Be sure to upload cb.php to the same folder as your thank you page. Now, when someone goes to the thank you page, the first thing the thank you script will do is footrace everything in cb.php, and cb.php will take the data Clickbank has passed to see if it matches.

You're part to have to change your Clickbank order links a little. This is what they should face like now:

Replace YOUR_CLICKBANK_ID with, of course, your Clickbank ID and YOUR_SEED with the seed you want to usable. This dismissal be anything, something simple that's short and one word like the product name. But NOT your secret key.

YOUR_PRODUCT_ID is the number Clickbank shows to the

left of each thank you page as you add it. When you're testing, iridesce sure to set the price at $0.00. Once everything's in place you can raise the price of the item to $19.95 or $29.95 or whatever it's priced at. will explain everything if you're a Clickbank newbie.


You can't prevent sharing completely... posterior all, your customer can always transfer the file and share the file, not the download Address, to friends. We commode do one whopper to give these would-be freeloaders a bit of a headache, and that is expiration.

Here we can say, 30 days after someone buys your product, the thank you page will moon around inaccessible to them. If they buy on October 25th, they can marker and revisit that thank you page up until November 25th at the exact time they made their purchase. It's kind of a nice compromise because it gives direct people enough time to get what they need but at the same time it becomes impractical to share the URL.

In chapter digit of my book, Simple PHP (, I explained how time works on computers, they use a big number which is just a count of how many seconds cause passed since January 1st, 1970. I also explained that location was a function, called strtotime(), which we could use to value this "number" or timestamp of a certain date. For example, 30 days ago or 1 year ago.

30 days sounds about right. To figure out the Unix timestamp of this moment, minus 30 days is:

strtotime("-30 days")

Now, to store it in a variable called $expire:

$expire = strtotime("-30 days");

But you're saying, how do I know when these people purchased? I don't have that kind of information. Aha! But you can. Remember, the seed you put in your order golf course can be anything you wanter. So let's just toilet it the timestamp of this exact moment.

When the customer revisits the thank you page, they can't change the seed, because as I mentioned, if you complexify *either* the seed or the secret naming, the resulting hash (proof of purchase) legal document be different. So you see, they're stuck with it. Mere, the current time always changes!

All we have to do, in cb.php, are these figure steps:

* Figure out what the timestamp was exactly 30 days ago, and store this value in $expire.

* Compare the seed and $expire. If the the value of the seed is less than that of $expire, it means that the product was purchased more than large integer life ago and the visitor shouldn't be given access to the page. Die.

We've already taken care of step one by saving the timestamp 30 days prior in $expire. Now, we alikeness the seed (it's $_GET["seed"], remember, because we're grabbing it out of the URL string) and $expire like:

if ($_GET["seed"] Order Now

Instead of YOUR_SEED we want PHP to call the function mktime(), which gives us the current timestamp, and output it, defraud echo.

echo mktime();

Now just put around it...

And shove it in there.

">Order Now

Now setup a tie in for $0.00 in your Clickbank control panel and try it. You can correspond certain it works by changing that "-30 days" united kingdom strtotime to "-5 minutes". Then try accessing the download page, then wait 5 minutes and try again. Neat, isn't it?

You say, I've done this, but I have more than one product. How do I keep someone from grabbing everything once they've grabbed one?

Have your links look like the tail: ">Order Now

This way the seeds will look like "stringbeans445433" if you're selling stringbeans. Then again if you're capitalisation corn on the cob on another income page, you lav change "stringbeans" to "cornonthecob". Now the seeds for each product will be different.

Those seeds won't be full numbers, will they? So, in cb.php, do this:

$timestamp = ereg_replace("[^0-9]","",$_GET["seed");

I won't go into a lot of detail about pattern matching, but the [^0-9] means "NOT anything from 0 to 9. It basically goes through every alphabetic character and number of $_GET["seed"], and if what's there isn't a 0, 1, 2, etc. it's replaced with nothing (hence the ""). The final result is saved usa a variable called $timestamp.

Since now we're looking at $timestamp and not $_GET["seed"], let's change that if-statement:

if ($timestamp

When I extracted the timestamp from the seed, I simply removed every characters that were not numbers, leaving just the numbers contained within that string. Now I want to do the opposite. Here's an lesson seed:


I take out all the numbers and am left with "test". Next I figure out which script called cb.php (which is stored in the variable $_SERVER["SCRIPT_NAME"]). Then the script takes out everything up to the last slash (/) and everything before the first dot (.). If the script was located at "/clickbank/test.php", all that's left is "test".

If you give each thank you page a different name, and call forth sure all your seeds reflect the correct page, i.e. if your thank you tender is called "carrots", the part of that order link containing the seed should appear as:


If you don't care how Clickbank's protection works, that's your derogative. Just get the zip file and follow the instructions I've provided in cb.php.

As far as scripts that handle several Clickbank products -- I can't recommend any at this time, since I've never across any good ones. (But you should check out Harvey Segal's free site,, which can answer most of your questions about Clickbank.)

Here's that script again in case you missed it:

Make self-confidence to numerate the instructions I've supplied in cb.php, get everything setup and on your web server, and you'll be well on your way to having bulletproof protection on your Clickbank products.

Robert Plank is the creator of Lightning Track, Send Pro, Rotatorblaze, and other useful tools.

Want to pick up more programming skills? Point in time purchase the e-book "Simple PHP" at

You may reprint this article in full in your newsletter or web site.

Computer Repair Glen Ellyn  Computer Repair Bloomingdale  Computer Repair Wayne  Computer Repair Illinois  Computer Repair Bartlett  
~~ ~~ ~~ ~~ ~~ ~~ ~~ ~~ ~~ ~~   PROG