secure script to only run once

phence

I have a script that inserts data into a mysql database.
Now, currently if i refresh the page, ofcourse it enters that data a second time.

How do i write something so that it makes sure once that particular data was entered once, that i can never be entered again.

Ofcourse, this is to ensure that a person doesn't get more than they paid for.

Thank-you,
Phence

konsu

before you insert data, check if data are already there, if so, do not insert anything.

phence

well, i don't think that would be sufficient because it would still allow the user to refresh the page and insert some data.

i was wondering if there was another way.

i have tried things like this but it doesn't work:

if ($_SESSION['check'] !== "yes"){
     // mysql query
     // unset variables
     $_SESSION['check'] = 'yes';
     exit;
}

LordShryku

The session check is fine. Are you doing a session_start()? If not, session variables won't be initialized anyway. I've used session variables with timestamps to check the time posted. I'm pretty sure this forum uses the same method.

konsu

i do not understand why refreshing the page (which effectively just resubmits the form) would add new data if your page checks if data are there already on form submits.

phence

konsu,
the form is a couple of pages back, session data is holding all the information that is entered in to the DB. after the query to insert the data is completed, i then unset the sessions. when the page is refreshed the only data entered will be unset variables, with the exception of the username, b/c i want to keep the user logged in and so not want to unset the username session.

lordshryku,
i do have a session_start(); statement, and it doesn't seem to be catching it.
here's my code...

<?
session_start();
//... 

if ($_SESSION['check'] !== "yes"){
	// query
	$query = mysql_query(/* query */) 
			 or die(mysql_error());

// Display Confirmation of Listing Creation
echo "Your data has been entered";

// DESTROY SESSION DATA FOR THE LISTING CREATED
unset($_SESSION['var']);

// Set check variable
$_SESSION['check'] = 'yes';
exit;
}else{
	echo "Unfortunatly this pages content is private and cannot be accessed!";
}
?>

Thank-you for all the help!
-phence

LordShryku

Using the sessions to store the data, I'm wondering if there's just a simple empty check you could do on one of the variables to see whether to insert or not. Do you have one of those variables, beyond the username, that would always need to be present? If so, I'd say checking on that variable would be the first thing to do since it will have been unset in the first go-round.

session_start();
if(!empty($_SESSION['var'])) {
   # do query
   unset($_SESSION['var']);
}
else
   echo 'No data passed';

The same might apply to the snippet you posted above. Just setting $_SESSION['check'], then checking for isset would be fine. I don't see why it's blowing up, but it may have something to do with the strict checking you're doing on value and type (though I don't know what that would be defined as other than string).

konsu

i am saying that your database contains data that you enter, if before adding data to the database your page queried the database and checked if data is already there, you won't need to maintain session state to remember that the data have been entered. what about when the session expires? the same user will be able to log in again and enter the same data again?

phence

lordshryku,
That worked! Thank-you.

konsu,
Thank you for all your help and consideration too. The user ought to be able to enter the same data again if they want, they'll be paying for it though. I just needed to stop them from refreshing the page or going back to it and doubleing thier order without paying for it agian.

If there is anything else i ought to consider, please let me know.

konsu

I see. it depends on the nature of the orders in your system of course but usually when orders are just items like books, the user is asked to enter the number of items she wants to get so resubmitting the same form makes no difference. ; -)