I believe this should do what you want it to and it should at least give you the idea - it was originally part of a larger post Stop multiple submits for a html from regarding the prevention of actual double submission.
Looking at it again, expecting you to sub that yourself might be too much of an ask, so here is a subbed version of it. You may want to re-implement the disabling of the submit button but it seems you actually want it to be enabled continuously so I have removed that code here for the sake of clarity.
You may need to adjust the counts - not sure how many multiple automatic submissions might occur - as it stands this would account for one, but after that it will not accept anything until the next "real" submission.
At that point the PHP code could request user intervention along the lines of "Did you really submit that twice?" or it could simply ignore the submission. The same is true for the JavaScript which can ask for confirmation before it re-submits at all, as per @symcbean's suggestion - belt and braces always a good idea! If you click while it is still submitting you should get the option to submit twice deliberately, or cancel.
As far as I can tell in this version, if you comment out the keyPress event submit_this(); call for an F5 key press, it will not accept an F5 submission for a refresh. - When the keyPress function is in action, pressing F5 submits without the usual confirmation warning you would get for a refresh.
I have test run this but can only wait for your confirmation to see if it copes with automatic re-submission as well. If you click the browser refresh button the submission is not accepted in the PHP. The submission resulting from a Ctrl+R refresh is also not accepted. Hopefully this mirrors the re-submission scenario. I have put back the alert for a faster click than the page was being submitted at as it was not possible to tell whether the confirm/cancel was working. You could experiment with that!
<?php
session_start();
if (!isset($_POST['hidden_input'])) $hidden_input = 1;
if (!isset($_SESSION['submit_count_input'])) $_SESSION['submit_count_input'] = -1;
if (isset($_POST['hidden_input'])) $hidden_input = intval($_POST['hidden_input']);
// detect difference between JavaScript submitted value and possible automatic ones
if (($hidden_input - $_SESSION['submit_count_input']) == 1){
// do your processing here
//$submit_count_input should always be 1 behind
echo "Thank you. Form processed";
}else{
// correct the balance between $hidden_input and $submit_count_input
$_SESSION['submit_count_input'] = ($hidden_input - 1); // will be incremented so will be -1 effectively
echo "Form not processed.";
}
// remove this echo section - just for testing
echo " Control Token: " . $hidden_input . " ";
echo " Submit Count: " . $_SESSION['submit_count_input']; // to show it submits but does not process form
$_SESSION['submit_count_input']++;
?>
<!DOCTYPE html>
<html>
<head>
<script language="javascript">
document.onkeydown=function(e) {
var event = window.event || e;
if (event.keyCode == 116) {
event.keyCode = 0;
submit_this();
return false;
}
}
function submit_this(){
if(document.getElementById('submit_count_input').value - document.getElementById('hidden_input').value == -1) {
// Warning when submit clicked before previous submission finished confirm/cancel option as per link below could be used
alert("Easy Tiger - please slow down a bit!");
}else{
document.getElementById('hidden_input').value = 1+parseInt(document.getElementById('hidden_input').value);
document.form.submit();
}
}
</script>
</head>
<body>
<form name="form" id="form" action="<?php echo htmlspecialchars($_SERVER['PHP_SELF']) ?>" method="post">
<input type="hidden" name="hidden_input" id="hidden_input" value="<?php echo $hidden_input ?>" />
<input type="hidden" name="submit_count_input" id="submit_count_input" value="<?php echo intval($_SESSION['submit_count_input']) ?>" />
<input type="button" name="sbutton" id="sbutton" value="Submit" onclick="submit_this();" />
</form>
<a href="<?php echo htmlspecialchars($_SERVER['REQUEST_URI']); ?>">Click to start a new submission</a>
</body>
</html>
Confirm/Cancel JavaScript dialogue box JavaScript confirm cancel button not stopping JavaScript
With regard to the secondary issue of keeping the values in the submitted forms, without sessions, then that should be fairly straightforward even for a lot of forms if you use value="<?php echo htmlspecialchars($_POST['form_element_name_value'] ?>" in each form text box element's value. Make sure each text box has a name="something" for php to pick up as a $_POST - sorry if that is too obvious.
To address the desire for your users to be able to use F5 to submit the page you could capture the functionality and subvert it to an actual submit, but that is probably a nasty idea though it does work...and it would keep the PHP side fed with submitted data which could possibly still be distinguished from automatic resubmissions for failed connections.
document.onkeydown=function(e) {
var event = window.event || e;
if (event.keyCode == 116) {
event.keyCode = 0;
submit_this();
return false; }
}
To capture the actual refresh button on the browser you could look at this How to know whether refresh button or browser back button is clicked in firefox but subverting browser behaviour to force a given user experience is something which is generally frowned upon.
