How To Redirect a Page after Second Attempted Refresh

[typomaniac]

I've been trying to figure out a way to re-direct a page if its refreshed after page has loaded. I found a way to do it with javascript and does exactly what I want, that is, after the page is loaded, if a page refresh is attempted it re-directs to another page and if an attempt is made to use the back button it returns to the page it loaded from. Reason for this is because the page in question sends out an email and makes an entry into a database when it loads and does the same if refreshed. It is part of a password recovery script. I'm including the javascript in case it is of help.

<script language="javascript">
 window.onbeforeunload = function() { 
 window.setTimeout(function () { 
  window.location = 'page.php';
 }, 0); 
 window.onbeforeunload = null; // necessary to prevent infinite loop, that kills your browser 
}
</script> 

I'm all thumbs with .js and happened upon this one.

[NickMNS]

Reason for this is because the page in question sends out an email and makes an entry into a database when it loads and does the same if refreshed.

Respectfully you should address the root cause of the problem and not try to implement a work around. I'm not sure what your script is doing exactly as you description is unclear. I assume or guessing that there is a form that is submitted, likely with a post request and the response of the post request reloads the page. You can either redirect the page after the request (I can't help with specific as I have next to no experience with PHP) or you can prevent the page from reloading by submitting the form using an AJAX request and using preventDefault in javascript, then reset the form, or remove the form from the page.

In addition you can safe guard your DB by putting a timer that blocks the record from being updated again for some reasonable period of time.

Messing with refresh and back buttons is rarely a good idea, it really bothers users when they click back and it doesn't go back to where it should.

[typomaniac]

Sorry for the weak description. Is part of a password reset script for forgotten/lost passwords. A form is submitted where a user submits their username and when the form is submitted, the username is matched against a database and if a match is found, sends an email to the address associated with the username. At the same time a unique access code is created, which along with the usernames's id code in the db is entered into table2. The email message contains the code which is then matched against the access code in table2. The page which opens when the form is submitted has a message informing the user of the email sent. After a given period of time the access code in the email becomes useless and is deleted from the db which produces a message informing the user that the page they are looking for no longer exists. The problem is, the page, until the time is up submits a new code to the db with a new expiration period (controlled with a timestamp) with a page refresh. I'm looking for a way using php to make it impossible to keep getting new codes submitted to the db by simply refreshing the page. I can do it with javascript but want to keep it server side for security reasons.

[NickMNS]

The problem is, the page, until the time is up submits a new code to the db with a new expiration period (controlled with a timestamp) with a page refresh.

It should not be a page refresh but rather a redirect to some other page, maybe a page stating the email was sent or to the login page. As I said I don't know the PHP specifics but I assume a redirect is straight forward.

[topr8]

I'm looking for a way using php to make it impossible to keep getting new codes submitted to the db by simply refreshing the page

just query the database to see if that username has been submitted in the last x minutes or whatever your timeframe is, if it has then don't run the query to generate the access code and don't send the email.

[typomaniac]

to: topr8,
Thanks, I was so busy finding all the things that don't work I missed the answer. Actually, querying the database to see if the username is in the table related to the operation in question is all that is needed because every time the user refreshed the page a fresh entry was made to that table. Your suggestion to query the db to see if that username has been submitted in the last x minutes was an added bonus for me involving something else. Thank you so much for your time & reply & answer to my dilemna.

to: NickMNS ,
I appreciate your time & suggestions also. The problem was not about looking for a solution to refresh the page but to prevent the user from refreshing manually. My fault for not being clear. Thank you also for your time & replies & suggestions. All information is of use to me.