form submit and back button

NZ_Kiwis

So I have a basic form

myform.php which posts to process.php and then via a header("LOCATION: index.php"); it redirects the user to my index.

If a user hits back space they sometimes process the process.php again, I want to stop that from happening and if a user does they will maybe be directed to twice.php?

however a user on index.php MAY want to complete myform.php again.

how can I allow this?

NZ_Kiwis

I was thinking on myform.php I would set a session with a unique code and also have a hidden field with this value, if this session and hidden post match on process.php then the form will submit and the session code will change. if it doesn't then the user will be redirected.

how can i ensure the code will change when a user uses the back button though?

sneakyimp

This is a tricky question and one that interests me also.

One possibility is to remove/alter the page's entry in the browser history. I'm not sure that all browsers will permit this (and it might be quite nasty when you start dealing with bazillions of browser possibilities) but the idea is that you would remove the submitted form entry from your browser's history so there'd be no way to click "back" and end up on it again. Mozilla has some documentation on manipulating the browser history -- apparently it's a feature of HTML5. There's also history.js which I found pretty confusing.

If you are not able to remove the dangerous history entry, then you will need to maintain some information server-side that you can check -- perhaps in session or via query string? For instance, if someone has submitted the form, you could set a cookie that says there was a recent submission. This cookie could stay set until the user closes their browser or something.