On a business listing in a directory I have a button which will lead to a custom plugin.

The custom plugin needs to know the userid of the user (registered user) who clicked the button to get here, plus the business id of the page it came from.

How do I track that info in the plugin?



Although you can put parameters on a URL link, be really careful about the parameters you use.

For example, the other answer suggest using a parameter like this:


Using the user ID number isn't really safe. What is to stop an unscrupulous person to use your link, but another user ID number? Bad things might (or might not) happen, depending on how you use that value. (Not to mention the possible exposure of user IDs....what if the nefarious person used a user ID of '1' - which is usually the 'admin' user?)

Better to use a session variable to keep track of someone accessing your site. Or, a cookie (although there are those pesky GDPR guys to worry about).

But I am not a fan of using query strings that contains possible personal information.


As for implementation (or even the code), I leave that to the OP. But I would

  • create a GUID value unique to that user. Do it after a login, and store it as a session
  • create the other variables you need
  • put the GUID together with the other variables. If you want, encode them a bit. Maybe an array into JSON? Whatever works
  • add that value to the URL
  • give the URL to the visitor

When the user click on the URL

  • check the GUID value in your session variable to ensure it matches with the GUID in the URL
  • if OK, extract the other values as needed
  • if not OK, put up a warning/error message to the visitor asking them to log in and try again

The GUID is a value that can't be (easily) figured out. Make it 40 chars long. Lots of GUID generator functions available on the googles/bings/ducks.

Storing it as a session variable means it will be available to the user as long as they stay on your site (until the session variable expires).

If you need to further obfuscate the other variables in the query string (that are added to the GUID variable), then encode/decode as needed.

Code to do all of this is on the googles/bings/ducks. You should be able to find something that you can modify for your specific needs.

The above is just a quick idea. You might think of enhancements that are useful to your situation.

| improve this answer | |
  • Agreed, the first route makes no sense and is easily exploitable. Do you have an example of how your proposal may work with this scenario? Not only am I tracking the user ID but the listing ID from which the button was clicked.... – Shaun21uk May 28 '19 at 22:20
  • See the added info to my answer. – Rick Hellewell May 29 '19 at 0:22
  • Ok, thank you. It's obvious I lot of research to do in this area - thanks for giving me some ideas for a starting point. – Shaun21uk May 29 '19 at 18:39

Not really sure, but you can pass a variable on that link, and load the desired page with the variable in URL.

<?php $user_id = get_current_user_id(); ?>
<a href="/my-plugin-url<?php echo $user_id; ?>">View/Download plugin</a>

This will load /my-plugin-url page, with the user_id to track

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.