Insert same data into database

Question

I have a web-based form that accepts student information. After I've Inserted data I want it to be still available even if I refresh the browser It would mean that 2 rows are the same but I dont want to insert the same data again. How can this be possible?

My code are here:

<form method="post" action="insert.php" >
    <table>
        <tr>
            <td width="22%"> Name</td>
            <td width="4%"></td>
            <td width="74%"><input type="text" name="name"  > </td>
        </tr>
        <tr>
            <td>Information </td>
            <td></td>
            <td><input type="text" name="infomn" ></td>
        </tr>
        <tr>
            <td>Email </td>
            <td></td>
            <td><input type="text" name="email" ></td>
        </tr>
        <tr>
            <td>Password </td>
            <td></td>
            <td><input type="password" name="password" ></td>
        </tr>
        <tr>  
            <td colspan="3"> </td>
        </tr>
        <tr>
           <td></td>
           <td></td>
           <td ><input type="submit" name="submit" value="Insert"  >
        </td>
        </tr>
    </table>
</form>

insert.php:

include("connect.php");

if($_POST['submit']){

    $name=$_POST[name];
    $info=$_POST[infomn];
    $emal=$_POST[email];
    $password=$_POST[password];

    $query = "insert into student(name,designation,email,password) values('$name','$info','$emal','$password')";

    mysql_query($query) or die("not successfully insert".mysql_error());

?>}

First: sanitise user input. Second: redirect after POST requests. — Lucius, May 02 '13 at 09:00
"Please say me what is the problem and solution." No! You say what the problem is. Also, please do your homework yourself. — likeitlikeit, May 02 '13 at 09:01
**ALWAYS** check the user input, the code you use is highly vulnerable to SQL injections ( http://mattbearman.com/2011/03/29/six-ways-to-protect-yourself-from-sql-injection/ ) — S.Visser, May 02 '13 at 09:01
Don't use mysql_query, it's deprecated. Also, use prepared statements. Also, emal should probably be email. — Jonast92, May 02 '13 at 09:03
After query execution , you could `redirect` to some other page, don't stay with `insert.php` — Ranjith, May 02 '13 at 09:03

score 1 · Answer 1 · answered May 02 '13 at 09:01

I would check if your values have been filled before attempting to insert your data.

if ($_POST['name']) {
    //Validate, escape, insert...
} else {
    //Display form...
}

Please please please make sure the data you insert into the database is escaped, especially if you're working with student data.

score 1 · Answer 2 · edited May 02 '13 at 09:17

At the moment it looks like this:

Info is posted to insert.php
You are located in insert.php and the variables posted exist aswell.
The database execution is performed with the existing data.
You refresh.
You never really leave the page because the refresh makes you go to the same page, so the browser assumes that the posted data should not be deleted but used again.

To avoid this, you must add

header("Location: index.php");

Or some similar code, to make sure that the user won't stay on the same page after the database execution is performed.

score 0 · Answer 3 · answered May 02 '13 at 09:04

0

Browser refresh posts the last action (again) to the server.

Use the Post/Redirect/Get pattern (http://en.wikipedia.org/wiki/Post/Redirect/Get) i.e. redirect always after successful action (in your case database insert).

answered May 02 '13 at 09:04

Khadim Ali

2,548
3
33
61

score 0 · Accepted Answer · edited May 23 '17 at 12:28

0

insert.php:

include("connect.php");

if(isset($_POST['submit'])) { // put isset() for checking if it submitted or not

$name=$_POST['name'];

$info=$_POST['infomn'];

$emal=$_POST['email'];

$password=$_POST['password'];


$query = "insert into student(name,designation,email,password)

          values('$name','$info','$emal','$password')";

if(mysql_query($query)) {
 header('Location:your_form_page.php'); // redirect to avoid inserting data while refreshing
}else { 
mysql_error() };

}

recommendation : Try use PDO How can I prevent SQL injection in PHP?

edited May 23 '17 at 12:28

Community

1
1

answered May 02 '13 at 09:08

6339

475
3
16

1

I'd take care to fix the security problems with the original code, which you have replicated. The `$_POST` array needs to be accessed using strings, otherwise warnings will be issued. The `header` you supply will work, but usually takes an upper-case 'L'. – halfer May 02 '13 at 09:16

Insert same data into database

4 Answers4