just how smart can an iframe get?

[bonzo meier]

hi everybody,

i am working on an idea on "intelligent" advertising right now, and i just came across the following:

a document (let´s call it "ad.php") is placed on different websites via iframe, in the sense that www.thisisjust.com/an/example.html is showing ad.php in an iframe. these two are not on the same server.

ad.php handles a couple of tracking-ID´s which makes traffic generated by this one specific ad.php recognizable as 'traffic-generated-on-www.thisisjust.com'. so if www.thisisjust.com owns the trackingID '1', it would actually call ad.php?trID=1).

now here´s my question: can ad.php BY ANY MEAN 'know' which site on www.thisisjust.com calls it?

i mean, by checking the trID, ad.php knows that www.thisisjust.com is calling, but it can not know that it is being placed on the particular www.thisisjust.com/an/example.html. or can it?

so my question (in other words) is: how can one get the complete url of a website through a document that is shown on that website in an iframe?

scripting wizards apply! i will donor generously!

peace, bonzo

[Thewinator]

If im not mistaking javascript can retrieve its parents url.
Somewhere along the lines of

var exampleSiteUrl = parent.href;

You can pass this on with ajax or put in in a hidden field and refresh the iframe.

[Jober68]

Have you tried using a "requre" or "include" function and specifying the server? That may work even better than an Iframe if you are trying to get a php script out of it.

[Hazirak]

To the best of my knowledge, the only way you could do this is to refer to ad's ID tag. As a security feature, a web page in an iframe that is from a different server than the page displaying it cannot access the properties of its parent, and vice versa.

What you could do is use PHP in your ad to read out the page's ID using $_GET['trID'], then compare that ID with a list in a text file or an SQL database. From there the script could match that ID number up with its assigned site, then log it, email it to you, throw it on an internet billboard, or whatever you please.

If for whatever reason PHP is out of the question, you could use Javascript to retrieve the name/value pairs, though this is a more complicated process - Javascript has no built-in methods for accessing stuff after the question mark in a URL. I did once do it though, and while I can't remember the exact method I used, what I did was search the URL for the name and recorded it in one array, and then took its value and recorded it in a second array with the same value... for example, in a url with "?view=23", "view" would be recorded in array1[0], and "23" would be recorded in array2[0].

[bonzo meier]

well i have been thinking about the javascript-parent.href-thing, but as hazirak says, this doesn´t work (i didn´t know it was for security reasons, though).

unfortunately i do not have access to the showing pages (www.thisisjust.com in the example). it is just that a sourcecode of the iframe (with source and everything) is being passed to webmasters who are in the ad-program.

but: as i am in the position to determine the source code that is being passed to the webmasters, i probably might as well write a javascript that
a) reads the document´s url (which it can, because it is pasted directly to the page by the webmaster)
b) produces an iframe with the ad.php?url='www.thisisthecomplete.com/stuff/iwanna.php?var=get' in it.

if i pass this javascript instead of the iframe-source code, is this supposed to work?

@jober68: require/include will only work on php-sites, but these ads must run on plain .html, too

peace, bonzo