[cd34]

alter the url and keep the code within the url prior to the query string.

http://site.com/affiliatecode/blah/index.html

surfer's can't easily muck with it, and you know it is always there, sort of a prestate. If you're not using Tux or Zeus or some mass virtual hosting, you could always use subdomains -- i.e. http://affiliatecode.hostname.com/whatever/

caveat here is that you need to ensure that you never refer to a directory as http://site.com/dirname because apache will rewrite the entry to the default host. Not to say you can't write a mod_rewrite to overcome this behavior, but, every step you add for a webmaster, the more steps are there for tracking leaks.

To me, URL munging is the only way to do it as accurately as possible. Can't use cookies if you are traversing multiple domains unless you have webbugs on every page.

You could also do a safety check of the ip address/useragent as they bounce around, and possibly use a cookie as a third safety check. However, since the web is stateless, its all guesswork. Guesswork that can attain pretty high % of reliability.