php: Preventing Form re-submisson

Question

I have a php sign up process for uses. When the user gets to the second last page of the sign-up process, it shows a summary of all the signup details and the submit button(Confirm and Pay button basically). Now when the user clicks this button, all those details gets posted to the sql database and that user is created in the DB with a username and password. Now the problem is, if you click that submit button more than once, it resubmits the data and creates duplicate entries in the database, where each duplicate entry has the same details(name, email etc), but different usernames and passwords. How do I prevent this? I know you can submit and postback to self right after but how do I do that exactly? I tried to implement this code but it does not work: http://www.bjw.co.nz/developer/general/75-how-to-prevent-form-resubmission

Thanks

Answer 1

Aside from messing with the PHP code or the DOM, why not modify your database table to use unique keys. This way regardless of how many times the user clicks a submit button, the database simply wont care.

This may help you: “INSERT IGNORE” vs “INSERT … ON DUPLICATE KEY UPDATE”

Answer 2

You should save a value into the PHP session that identifies if the form is already submitted, using $_SESSION. The PHP Session is locked while each request carries out, so when the first submit locks it, the second will have to wait until the first submit is finished and has set the value. The second request will afterwards read it, and break upon the value being set to already submitted.

Here's an example of how this could be done. It could probably incorporate bugs if one user is doing several registrations at once (why should he?).

On the page that contains the submit button of the form, you should set a marker:

session_start();
$_SESSION["RegistrationSubmitted"] = false;

This says that the registration that a user is currently doing has not been submitted yet.

On the page that is being submitted (POSTed) to, you can check this value:

session_start();
if (isset($_SESSION["RegistrationSubmitted"]) {
    if ($_SESSION["RegistrationSubmitted"] == true) {
         die("Registration has already been submitted!");
    } else {
         // Process registration here
         $_SESSION["RegistrationSubmitted"] == true;
    }
} else {
    die("Last registration page hasn't been reached! (A bot?)");
}

Answer 3

I would advise a bit of JavaScript in this situation. Add the following to the submit button:

onclick="this.disabled=true;"

This will disable the button once it is clicked so that it can't be clicked again.

Answer 4

You could create a form key like:

<input type="hidden" name="form-key" value="<?php echo $last_order_datetime; ?>" />

Then, when a new order is submitted, check if the value of $_POST['form-key'] is exactly equal to the most recent order stored.

If it is, process the form. else, it is a resubmit or some other attempt.