how to prevent users from rePOSTing data on refresh?

sneakyimp

hi:

i have encountered several cases recently where i perform some sensitive operation after POSTing some data (like a financial transaction or sending 1000 emails or something). if the user hits REFRESH, then they might just do the important/special thing all over again.

i get a warning in IE6 that says "page expired/do you want to repost?" but dumb users cannot be depended on to figure out what is up.

how do you avoid this situation? a page redirect perhaps? but how? and what if you want to display a really long progress report (like a line for each email sent or something)?

any help would be much appreciated.

ragnar

Use _GET. This eliminated "reload this page..." dialogs.
After an action is sent, forward the user to another page with meta or header(); that way when they refresh, the data is no longer encased in the http transaction, resulting in no more problems.

Yay!

sneakyimp

I don't want to use GET because that would cause the same problem. A refresh would result in the transaction being repeated (and another 1000 emails being sent!).

as far as page redirect goes, i have two questions:

1) what if you have a VERY LARGE progress report that is generated by the page that handles your POST. if you redirect to another page, what is a good way to hand this data over? a log file? session variable? other?

2) what is the best technique to use in order to redirect...i'm not certain but I think if you use header() then there's a possibility that a refresh will ONCE AGAIN redo the entire action thing. haven't tested this. should i use META REFRESH?

cnperry

a meta refresh will work. I also know it's sloppy HTML, but you can put it anywhere in the page you need to and it will work. I use it in one case to clear the url of several GET variables after they are used in a specific operation.

sneakyimp

thanks for your response.

does ANYONE have some experience with the log thing...writing a log file is kind of a pain...especially if permissions aren't what you need them to be.

cnperry

try awstats. it will automatically analyze your apache log files for you.
http://wwwawstats.net

sneakyimp

i don't need a analysis of my stats. i need a reliable way to pass a large amount of information created when someone POSTs information on a form. try reading the post over...