Originally Posted by ddfGandalf

Well we only use ccbill in our program.

and ref codes look like http://refer..blahblah&HTML=http://w...=theirccbillid
(they have the raw click count from this, thats why we need the ccbill cookie too)

It will keep that ref while the visitor browses, and when he gets to the ccbill join page, we have it hardcoded like


input type=hidden name=ccbill_referer value="theirccbillid"

I think the hardcoded passed variable doesnt care with the cookie, so the outside hijack attempts can be lowered this way.