prevention of re-submission

nuttynibbles

hey, im creating a webpage. the flow of the page is:

order.php->summary.php->submitted.php..

in ORDER.php, user key in their particulars. Once the user click NEXT, the SUMMARY.php will display what the user has entered before he submits the whole form into database.
Once he submit, it will call SUBMITTED.php where it process the db. after which SUBMITTED.php will display a msg saying your transaction is successul or failed.

k the problem is, if the user click the back button in SUBMITTED.php, he/she will be brought back to SUMMARY.php where the user can re-submit the whole form again. so how do i prevent user from doing tt.

sfullman

you might try this but it requires a whole new approach

have an <iframe id="exepage"></iframe> on your posting pages. Form target=exepage and action is a page which will not be seen. put your iframe in a div tag with style="display:none;"

Then, when the user posts they will post to the iframe. The receiving page will evaluate the form post, determine what to do, and then show the following code:

if($all_is_OK){
   ?><script>
      window.parent.location='success.php
    </script><?php
   exit;
}else{
   ?><script defer>
      alert('there were problems wiht your form, <?php echo $problems?>');
   </script><?php
   exit;
}

this way, each parent page seen is by "GET" and not by "POST" and you'll never have to worry about this when going "back".

There are other things to think about but see if this idea makes sense to you.

Samuel

nuttynibbles

er let me clarfied, so i put <iframe id="exepage"></iframe> in summary.php? and where do i put the Form target=exepage?
and action is a page which will not be seen??

bogu

In order.php u can set a session and in submitted.php u destroy it, in summary.php u check is the session is set-ed if not u redirect him somewhere else ...

There are lots of approach this is the first that come in my mind ...

bradgrafelman

I like bogu's approach because it doesn't deal with iframes.

What'd you do is start a session ([man]session_start/man or the man page [man]session[/man]), create some session variable such as $_SESSION['submit'], and when the script that handles the POST'ed data is run, make sure it only processes the form if the session key is set. After you handle the POST'ed data, you would remove the session key, so that if you simply refresh the page, the session key will not be set and it will not process the data.