Use CFCONTENT to
secretly track readers of your emails from ColdFusion.
Many of us
have used the CFCONTENT tag that comes with ColdFusion to serve up files to
browsers, but very few ColdFusion developers are aware that the CFCONTENT tag
can be used in conjunction with the HTML <IMG> tag to server up graphics
such as JPEGs and GIFs. In this case,
the why of doing this is perhaps just as interesting as the how. It turns out that using this technique is
perfect for use with creating an advertising banner server, controlling access
to graphic files or on the more sinister side, for creating “web bugs.” If you don’t recall, a web bug is a graphic
(usually an invisible one pixel shim) that is embedded in an HTML email message
or Word document that tips off its creator when and who is reading without the
reader even knowing their access was logged.
If you’ve never used the
CFCONTENT tag before, it’s an excellent tool to know about. In layman’s terms, CFCONTENT tells a web
browser that it’s about to receive a non-HTML file, and then sends it to the
browser. It does this by allowing you
to specify a MIME type and a filename to send to the browser. So a ColdFusion template name can be put in
place of a JPEG or GIF file like so:
The ColdFusion template
“send_graphic.cfm” will contain a CFCONTENT tag that specifies “image/gif” for
the MIME type and is pointed at the name of an actual .GIF file. The kicker is that you can also include
code that logs the access to the file to a database table or does just about
anything else ColdFusion can do. This
is where privacy advocates get upset.
If logging access isn’t bad enough, your send_graphic.cfm file could
also use CFCOOKIE to set a cookie on the viewer’s machine. In turn you could later check for the cookie
when the user visits your website. If
the cookie IS there, then you could infer that the person viewed the email and
then decided to visit the website. And
that’s just the beginning of the worst of the possibilities.
A more common use of
CFCONTENT in this way is to serve graphics for a banner server-type
application. The logistics and
possibilities are about the same as for a web bug. The only major difference is that even less savvy Internet users
are aware that someone is probably logging each and every time the graphic is
viewed. In the same spirit as with
security flaws in applications, the authors of this article feel that its
better to make as many people as possible aware of these techniques and then
let them decide how to use the information.
This is after all real world stuff that is regularly used by web
programmers at Microsoft, Barnes and Noble and other major direct
emailers. So in that spirit, lets take
a look at some example code.
INSERT INTO log_image_views
// Force the browser to download the
image file. //--->
TYPE="image/gif" FILE=" c:\images\invisible_pixel.gif">
This simple example uses a
custom tag called <CFX_NSLookup> free from Lewis Sellar’s Intrafoundation
that is used to get the user’s domain name from the IP Address. We will use CFTRY tags to catch any possible
logging failures and just send the image anyway. Finally, we use CFSETTING to suppress any extra white space that
might be generated by our code formatting.
To avoid problems with web browsers, the only output we need or want
comes from CFCONTENT.
So there you have it. When the web browser or email client loads
the HTML containing: <IMG SRC="http://www.myserver.com/images/send_graphic.cfm">
their IP Address, date and possibly their domain name are logged in a database
and the graphic sent, and the uneducated viewer is none-the-wiser.
Advantages of using
CFCONTENT to serve graphics:
The actual location of
the file does not have to be in the accessible web path (This is good if your
users are paying for the files such as graphics libraries, PDF reports or
You can include code in
the template that can log access to the file
The file to be
displayed can be dynamically selected based on other criteria. Eg random image
display, graphic size based on connection speed etc.
Did they read the email?
Did you ever want to know
who reads your email? Just embed their email address in a web bug URL. You'll
probably be CFLOOPING over a list of e-mail addresses, so in your CFMAIL tag,
you'd embed the following web bug (where email is the name of the field that
contains your e-mail addresses.
Then on your server, you'd
have the following script (saved as /bug.cfm).
<CFSET dtDate =
isdefined("ID") and len(ID)>
UPDATE EmailList SET HasRead
= #dtDate# WHERE email='#ID#'
graphics let you track who reads email or Word documents. ColdFusion can server
up smart web bugs or any other dynamic graphic using CFCONTENT.
Web bug FAQ
General privacy site
(firstname.lastname@example.org) is freelance ColdFusion programmer, MDCFUG speaker,
trainer and author. Michael Smith is president of TeraTech http://www.teratech.com/
, a 12-year-old Rockville, Maryland based consulting company that specializes
in ColdFusion, Database and Visual Basic development. Michael runs the MDCFUG and recently organized the two-day,
Washington, DC-based CFUN-2k conference that attracted more than 750
participants. You can reach Michael at email@example.com or 301-881-1440.