Referral or Affilate setup

I have a client who wants to add a referral plan to their eCart web site.
The third party would include a link on their web site, to my client's store, and then receive a % commission of the referred sales.

My first thought was to include a URL variable in the link so that a session was set once the visitor arrived via that link.
(www.clientsite.com/store.php?affiliateid=1234)

Then record the variable in the Orders table.

So...
1- Session is set on first page, setting the Affiliate ID from the URL.

<?php

if (!session_id()) session_start();

if(!isset($_SESSION["affiliateid"]))     {

  $_SESSION["affiliateid"] = "".$_GET['affiliateid']  ."";

}

?>

2- Then that session is stored in the Orders table on the confirm.php page.

But if I'm not mistaken, entering data from a URL is a security risk. Am I correct on that?

What would be the safest method to simply include a referral ID with each order (if one exists)?

Thanks,
TroyD

it's only a security risk if you don't scrub the data in the URL variable. use htmlentities() to prevent any security issues:

<?php 

if (!session_id()) session_start(); 

if(!isset($_SESSION["affiliateid"]))     { 

  $_SESSION["affiliateid"] = "".htmlentities($_GET['affiliateid'], ENT_QUOTES)  .""; 

} 

?>

Thanks so much Jason.
I thought I had read something like that somewhere before but couldn't find it.
This was very helpful.

Thanks,
TroyD