Yes, it could very well be abused if someone has a bot system that frequently changes IP addresses. The easiest limitation could be to limit the amount of traps you can set a day. For example, setting the script to 10 traps a day meaning a maximum of 10 people can visit your link per day before the player longer gets a gold bonus per visit. If you wanted to go one step further, a captcha or simple image verification (what's 8+2?) could deter the bots but I feel like just seeing if the person already visited (same IP address) should be sufficient. If someone really wanted to create a bot system, then it would only work 10 times so it wouldn't be worth it.
I guess the page that would redirect you is a simple landing page for the user whenever he clicks said link. I want something that will recognize that a user has clicked the link and will give the player a reward, in this case, gold. A "trap" link is more of the correct term instead of referral because it utilizes the player's unique ID so the system knows who should be getting the reward. The link that can be shared and given to friends (http://www.gamewar.com/page.php?x=230239) and would ultimately just be a landing page for the user. It directs them to a simple page. For example, say Robert visited John's link. It would literally just say:
"You visited John's page. 100 Gold has been given to John."
or
"You already visited John's page today. John did not receive any gold." (assuming Robert already visited John's link that day)
If you wanted to go further, I guess you could also determine if Robert was signed into his account when he clicked John's link. If he did, both John and Robert are given 100 gold. If Robert clicked John's link and wasn't logged in (aka not a registered user) then an additional option of registering his account could be available but just John receives 100 gold.
Does this clarify things up a bit? :)
