Skip to main content
Sometimes a template needs information that the shop does not know on its own: a campaign identifier from the URL, an attribute from a cookie set by a third-party system. For this case, there are two tag groups that both work according to the same pattern. CheckURLParam- reads any parameter from the requested address, CheckCookie- any cookie. Both consist of the same three tags with the same tasks.

​
The pattern in three steps

The tag with TouchData must come before the other two. It determines what DataOK and Data refer to. Without it, the two return nothing.
The shop only remembers one value per group at a time. Each new TouchData overwrites the previous one. You can therefore read several parameters one after the other, but not compare two at the same time. If you need a value again later, save it in a Design Control tag.

​
The difference between DataOK and Data

Both can be used as area tags, and they check different things.
The difference shows with a parameter without a value. With the address …/?flag=, CheckURLParam-DataOK applies because the parameter is there. CheckURLParam-Data does not apply because there is no value after it. For the question “was this parameter passed”, use DataOK; for “does it contain a value”, use Data.

​
Reading URL parameters

​
CheckURLParam-TouchData()

Specifies which parameter of the requested address is read. The name goes in the parentheses.
The parameter name is searched for exactly as you write it. Upper and lower case matter. Without a name in the parentheses, the tag is invalid.

​
Getting the name from another tag

CheckURLParam-TouchData() supports tag-in-tag. The parameter name can therefore come from another tag.
This option only exists for URL parameters. CheckCookie-TouchData() does not evaluate a tag in the parentheses; there, the name must be fixed in the template.

​
Reading cookies

​
CheckCookie-TouchData()

Specifies which cookie is read.
The shop searches for the name in the cookie header of the request. If another cookie’s name ends with your name, its value may be found: a search for sitzung also finds benutzersitzung. Therefore, choose unique names and check the result before you build on it.
A cookie whose value is in quotation marks is recognised correctly. The quotation marks themselves are not part of the value. The shop removes trailing spaces from a value without quotation marks.
A cookie comes from the visitor’s browser and can be changed there. Treat the value like any other external input and do not derive any authorisation from it.

​
Using external input safely

Both groups output values that the visitor determines themselves. Anyone can change the address, and the cookie as well.
For output in running text, this is uncritical: the shop outputs the values HTML-encoded, so an injected element is displayed as text and not executed.
In other contexts, this is not enough. Never insert such a value unchecked into JavaScript, an href attribute or a redirect. Instead, check it against a fixed list of permitted values, for example with the Design Control tags.
This is the usual pattern: read in the external value once, check it against the expected values, and only then do something. Anything that does not fit the list is silently ignored.
Reference: Design Control tags

​
The tags at a glance

All six tags are permitted on all templates.
  • Reference: Design Control tags
  • Materials: Cookies used
  • Guide: Tracking advertising success with Referer and SubReferer