Preventing database reentry with page refresh

Davidc316

Ok... confession time-

This question has came up on these forums a few times before.

But before everyone bites my head off, let me assure you, I've studied all of the threads in detail and so far we don't seem to be able to agree on the single best method of solving this common problem.

The problem is this... If you have a webpage with a PHP script that inserts records into a database, then the user can hit the page refresh button and every time he does so, the script adds another record into the database. This is not good.

So far, from what I've read there are several methods of dealing with this problem. A few of them are;

cookies (which I'm not into using cos some computers won't accept them),
sessions (which I admit to not knowing much about)
page redirects- so that when they submit the form they are redirected to a thanks page (but the flaw with this is that a malicious user could still use the "back" button on his browser and do a zillion database re-entries)

I'm sorry for repeating past questions, but in the light of the mass confusion that seems to be out there, I wonder if anyone could bring this all together and declare once and for all what the best method is.

My main worry is that I spend the next three days learning about sessions (or something), then I find out it's gonna be no use at all for this problem.

Thanks,

David

PS- I note with interest that this problem does not get a single mention in Sams Learn PHP in 24 hours book.

lanjoky

instead of using cookies or sessions ... why not just do a check before you run the insert comparing one ofthe required form fields to corresponding table field to see if they are a like ... if there is a record that contains that unique value dont do anything else continue with the insert. thats my $.02... what does everyone else think?

laserlight

I think that the answer is that there is no single best method, it all depends on the situation.

Consider this forum:
the solution is to check timings between submissions.
If a post is attempted within 30 seconds of an earlier post by the same user, it does not go through and the user is informed.

Consider a user system that requires unique usernames.
Testing the time between submissions may not be as good as simply checking if the given username has been submitted.

Davidc316

Thanks for the responses. I think you're both right!

Lan- that sounds like a great idea. The best thing about it is it's simple! (at least, at face value).

So, does that mean that my mission should be to figure out if there is a MYSQL command which compares all records and deletes where two similar records occur??? (by the way- there will never be two identical records on my database because, like most people, I've added an "Id" field which is basically a number that automatically increments.)

OR would a better method be to compair submission details from the point of the PHP form? (i.e.- before it even gets allowed anywhere near the MySQL database)??? I haven't got a clue how to do that but it would probably involve a way of adding a command which says something like:

"IF the submission details are the same as some previous submission details THEN tell the guy that you're not going to add the record"

(I wonder if such a magical command exists! 😛 )

Once again, thanks for the replies!

David

laserlight

What lanjoky suggested is essentially one of the possible methods I outlined, as cases in point.

It is not so much that the rows stored are identical, but rather that the values are identical.
For the case of the username, you could perform a search with the given username of the table.
If a username exists, there would be a negative response, otherwise you would simply insert a new row with that username.

Davidc316

Ok thanks for that.

I'll look into this one, but I'm confident that I'm on the right track.