Note Submitter: Chris
----
It took me a while to find out how to use PHP sessions to prevent HTML form re-submits. A user can re-submit a form via the backspace key/back arrow and/or the F5/refresh key. I needed to control if/when a HTML form could be resubmitted. Here's what I came up with:
<?php
strlen(session_id()) or session_start();
$_SESSION['err'] = ''; $exit = false;
do {
// check if form was previously submitted, e.g. user pressed "back" after submit
if(isset($_POST['submit']) and isset($_POST['SID']) and ($_POST['SID'] != session_id())) break;
// check if form previously verified, e.g. user pressed back after form receipt
if(isset($_SESSION['ok'])) { session_regenerate_id(true); session_destroy(); break; }
// break out of do-while if form has not been submitted yet
if(empty($_POST['submit'])) break;
// process form data if user hit form "submit" button
if(isset($_POST['submit'])) {
// clear vars after submit. previous form will be blank after browser back button
if(verify_form()) { session_regenerate_id(true); session_destroy(); $exit=true; display_receipt(); break; }
// keep vars after submit. allows browser back button to bring up previous form data
// if(verify_form()) { $_SESSION['err']=''; session_destroy(); $exit=true; display_receipt(); break; }
else { $_SESSION['err']="<p>Wrong answer $_SESSION[name]</p>"; }
}
} while(false);
$exit and exit;
// Move cleaned/valid POST data to SESSION. Only cleaned SESSION vars will be shown in html form
function verify_form() {
$_SESSION['name'] = htmlspecialchars(strtoupper($_POST['name'])); // clean POST data
if($_POST['great'] === 'yes') { $_SESSION['ok'] = 'ok'; return true; } // set if all data on the html form is valid
return false;
}
// display your "form was successfuly submitted" message
function display_receipt() { echo "I agree $_SESSION[name]<br>"; return; }
?>
<html><head></head><body>
<?php echo $_SESSION['err']; ?>
<form name="form1" action="http://<?php echo $_SERVER['HTTP_HOST'], $_SERVER['PHP_SELF']; ?>" method="post">
Name: <input type="text" name="name" value="<?php isset($_SESSION["name"]) and print $_SESSION["name"]; ?>">
Is PHP great? <input type="text" name="great" value="<?php isset($_SESSION["great"]) and print $_SESSION["great"]; ?>">
<input type="hidden" name="SID" value="<?php echo session_id(); ?>">
<input type="submit" name="submit" value="Submit">
</form></body></html>
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.