note 101443 deleted from session.examples by danbrown

Note Submitter: Chris ---- It took me a while to find out how to use PHP sessions to prevent HTML form re-submits. A user can re-submit a form via the backspace key/back arrow and/or the F5/refresh key. I needed to control if/when a HTML form could be resubmitted. Here's what I came up with: <?php strlen(session_id()) or session_start(); $_SESSION['err'] = ''; $exit = false; do { // check if form was previously submitted, e.g. user pressed "back" after submit if(isset($_POST['submit']) and isset($_POST['SID']) and ($_POST['SID'] != session_id())) break; // check if form previously verified, e.g. user pressed back after form receipt if(isset($_SESSION['ok'])) { session_regenerate_id(true); session_destroy(); break; } // break out of do-while if form has not been submitted yet if(empty($_POST['submit'])) break; // process form data if user hit form "submit" button if(isset($_POST['submit'])) { // clear vars after submit. previous form will be blank after browser back button if(verify_form()) { session_regenerate_id(true); session_destroy(); $exit=true; display_receipt(); break; } // keep vars after submit. allows browser back button to bring up previous form data // if(verify_form()) { $_SESSION['err']=''; session_destroy(); $exit=true; display_receipt(); break; } else { $_SESSION['err']="<p>Wrong answer $_SESSION[name]</p>"; } } } while(false); $exit and exit; // Move cleaned/valid POST data to SESSION. Only cleaned SESSION vars will be shown in html form function verify_form() { $_SESSION['name'] = htmlspecialchars(strtoupper($_POST['name'])); // clean POST data if($_POST['great'] === 'yes') { $_SESSION['ok'] = 'ok'; return true; } // set if all data on the html form is valid return false; } // display your "form was successfuly submitted" message function display_receipt() { echo "I agree $_SESSION[name]<br>"; return; } ?> <html><head></head><body> <?php echo $_SESSION['err']; ?> <form name="form1" action="http://<?php echo $_SERVER['HTTP_HOST'], $_SERVER['PHP_SELF']; ?>" method="post"> Name: <input type="text" name="name" value="<?php isset($_SESSION["name"]) and print $_SESSION["name"]; ?>"> Is PHP great? <input type="text" name="great" value="<?php isset($_SESSION["great"]) and print $_SESSION["great"]; ?>"> <input type="hidden" name="SID" value="<?php echo session_id(); ?>"> <input type="submit" name="submit" value="Submit"> </form></body></html>