Forum Moderators: coopster

Message Too Old, No Replies

Preventing formdata from being reposted by refresh

         

breezeman

4:53 pm on Jun 23, 2005 (gmt 0)

10+ Year Member



I have been puzzling to find a way to keep form data from being resubmitted by refreshing the page.

I thought of adding a random code that changes as soon as the form submission has been received, but it does not work. Probably it has to do with the way and order in which php processes a page but I am not sure.

This is what I tried:


$_SESSION['randomnumber']=makerandompassword();
echo '<form name="form1" method="POST" action="">';
echo '<input type="submit" value="submit">';
echo '<input name="rand" type="hidden" value="'.$_SESSION['randomnumber'].'">';
echo '</form>';
if (($_POST['rand'])==$_SESSION['randomnumber']) {
echo 'new submit received';
}
else
{ echo "refreshed";$_SESSION['randomnumber']=makerandompassword(); exit;}

Am I on the right track, or does anyone know another way?

jatar_k

4:57 pm on Jun 23, 2005 (gmt 0)

WebmasterWorld Administrator 10+ Year Member



the other option is to step out the processing script

form page > processing page > thanks page

they can refresh the thanks page as many times as they want and it just keeps saying thanks

breezeman

5:33 pm on Jun 23, 2005 (gmt 0)

10+ Year Member



Thanks sounds like a good way, haven't thought of that.

I tried the following but when I echo $_SESSION['rand'] on the process page it remains empty while on the form page it does have a value.

FORM PAGE test.php:


<?php
session_start();
include 'functions.php';
$SESSION['rand']=makerandompassword();
echo '<form name="form1" method="POST" action="process.php">';
echo '<input type="submit" value="submit">';
echo '<input name="rand" type="hidden" value="'.$SESSION['rand'].'">';
echo '</form>';
?>

PROCESS PAGE process.php


<?php
session_start();
//check form page
if (($_POST['rand'])==($_SESSION['rand'])) {
echo 'new';
//do other form processing here
header("Location: thanks.php");}
else { echo 'error resubmit';
echo $_POST['rand']; echo '-'.$_SESSION['rand'];
}
?>

THANKS PAGE thanks.php


<?php
session_start();
echo 'thanks';
include 'test.php';
?>

Sathallrin

5:36 pm on Jun 23, 2005 (gmt 0)

10+ Year Member



In your test.php you used $SESSION instead of $_SESSION

breezeman

6:00 pm on Jun 23, 2005 (gmt 0)

10+ Year Member



Thanks a lot both, that did the trick :)

moltar

6:18 pm on Jun 23, 2005 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



You can also test and compare input against current values in the database, if the content is supposed to be unique.

MattHock

3:45 pm on Jun 24, 2005 (gmt 0)

10+ Year Member



Sending a HTTP Redirect header from the posted-to script to another page after processing would do the trick. The browser will basically loose track of the posted-to page since it was redirected - it will have the directed-to page as the current one, and the back button goes to the form.