preventing repost - revisited

[Anon]

After an extensive search on the site for how to prevent reposting of form data, I have come to the conclusion that the easiest solution for me would be to process the form data, then push the user to a success page using the header(Location🙂 option.

While this is all fine and dandy for a canned success message, I was wondering about the following:

Typically when a user submits data on my site, I have what they entered included on the success page. Passing a user to a new page would cancel out my variables right? Is there any easy way to handle this without using a bunch of hidden input statements?

[Anon]

First, if you want to avoid a person to post more than one time the same thing, you could put a hidden input with a unique value like the person's IP addresse and a part of microtime()... example :
<INPUT NAME="unique_key" VALUE="<?= $_SERVER["REMOTE_ADDR"] . "@" . ereg_replace("^.* ", "", microtime()); ?>" TYPE=HIDDEN>

This would produce something like 189.234.65.111@1026912820

On the page you programmed the formed to get the user to, you check all values and store them. Of course, you check if the unique key already exists. If so => error, you can't post more than one time the same thing... If not => redirect. You store you variable before redirecting the user... on the page where you redirected the user, you show data he sent... if you stored them in MySQL, you make a MySQL request, if it's in a file, you open the file, etc. But if you only sent data by e-mail, you'll have to do something like :
$url = "./page_ok.php3?name=" . urlencode(stripslashes($POST["name"])) . "&address=" . address(stripslashes($POST["name"])) ..... etc .....
header("Location: $url\n");
Stripslashes() ? Replace \" by ", \' by ', etc.
Urlencode() ? Replace special character by % and its ASCII number, or something like that. Example, a space is %20.

If you stored you datas in MySQL, you'll have to sent the IP to the "ok page"... it could look like this :
$url = "./page_ok.php3?id=" . mysql_insert_id();
header("Location: $url\n");

Same thing for a file...

I hope this will help you.

[Anon]

This unique key you reference would be something that gets tored in the database right along with everything else? Or would it just be something to check against?

[Anon]

Personnally, I would store it, but you can put it in a cookie...