Stop form submit spamming via PHP script

Question

Basically I have a form that accesses a email script I made, and send a message with the content that the user sets in the given fields. I was wondering if it was possible to, through the PHP script, disable it from being submitted more than once...

It's an email form, so if the user presses the "submit" button more than once, it'll send the email more than once. If a person presses the submit button 100 times, 100 messages will be sent to my email.

So, my question is, is there anyway to stop a PHP script from running again once it's already been submitted?

Below is the code of the form.

<form action="http://sebastianalsina.com/contact/sendmail.php" method="post">
    <input type="text" placeholder="Name" name="name">
    <input type="text" placeholder="Email" name="email">
    <input type="text" placeholder="Subject" name="subject">
    <textarea placeholder="Write your message here" name="message" rows="6"></textarea>
    <input type="submit" name="submit" class="sendmessage" value="Send message">
</form>

Here is sendmail.php:

<?php
require 'PHPMailerAutoload.php';
include 'variables.php';

// receiver message

if ($_POST['name'] != "" && $_POST['email'] != "" && filter_var($_POST['email'], FILTER_VALIDATE_EMAIL) && $_POST['message'] != "") {
    $mail = new PHPMailer;

    $mail->AddReplyTo($_POST['email'], $_POST['name']);
    $mail->setFrom($fromEmail, $_POST['name'] . ' (' . $companyName . ' Web Mailer)');
    $mail->addAddress($toEmail);

    $mail->isHTML(true);

    $mail->Subject = $_POST['subject'];
    $mail->Body = '**CODE WAS REMOVED HERE BECAUSE IT WAS REALLY LONG**';
    $mail->AltBody = $_POST['message'];

    if(!$mail->send()) {
        header("Location: error.php");
    } else {
        header("Location: thankyou.php");
    }
} else {
        header("Location: error.php");
}
?>

set a session variable, check it every time the script starts up. if it's set, then obviously the script has already executed. — Marc B, Mar 23 '16 at 19:08
@yonessafari argh, I'm trying to NOT use captcha! Thanks for the suggestion, I will have to use that if I do not find a better solution. — Sebastian Alsina, Mar 23 '16 at 19:10
`session_start(); if(isset($_SESSION['foo'])) { die("stop spamming"); } else { $_SESSION['foo'] = true'; }` — Marc B, Mar 23 '16 at 19:10
@MarcB that works, but if the user wants to send another message after that they won't be able to because the session has been set. Do you know of a workaround for that? — Sebastian Alsina, Mar 23 '16 at 19:15
then check time delays, or compare contents of previous mail with current mail, blah blah blah. that's up to you. — Marc B, Mar 23 '16 at 19:17
Session, cookies, ip list can be hacked but captcha is good and safe. — ops, Mar 23 '16 at 19:20
@yonessafari I'm not really worried of hackers, just don't want people to accidentally hit submit 100 times. — Sebastian Alsina, Mar 23 '16 at 19:23
is your form redirected to another page when the user hits submit? or is the PHP code on the same page? — CodeGodie, Mar 23 '16 at 19:26
Related: [How to prevent robots from automatically filling up a form?](https://stackoverflow.com/q/2387496/1619432) — handle, Apr 13 '18 at 10:44

score 0 · Answer 1 · answered Mar 23 '16 at 20:13

0

ok so it seems your PHP and form code looks ok. The problem is that the user is not being prevented from hitting/clicking that button when sending the message.

One way to handle this is to disable the button once its clicked. This way, only one click is allowed until the page is reloaded (which you are already doing with a redirect in PHP)

First you need to give your form an ID:

<form id="message_form" action="http://sebastianalsina.com/contact/sendmail.php" method="post">

now use Javascript, to give the functionality:

var form = document.getElementById("message_form");
form.addEventListener('submit', function () {
    form.submit.disabled = true;
});

hope this helps.

answered Mar 23 '16 at 20:13

CodeGodie

12,116
6
37
66

Yes, this will work, and I found a similar suggestion elsewhere, but I really wanted to see if it was possible to stop the spamming via the PHP script, because if I'm stopping the spam via the HTML page (the form) I'll have to update the form in 10+ different places (for my customers sites), while if I did it through PHP I would only have to edit the script. Does that make sense? – Sebastian Alsina Mar 23 '16 at 20:16
to stop spamming you are better off using Captcha as people mentioned.. What kind of spamming do you mean exactly? – CodeGodie Mar 23 '16 at 20:17
1

Sorry, when I refer to spamming I mean that if the user presses submit multiple times, the message will be sent multiple times. I want to avoid that, via the PHP script if possible. – Sebastian Alsina Mar 23 '16 at 20:19
Sorry if this doesn't make sense, I always seem to have trouble explaining myself. – Sebastian Alsina Mar 23 '16 at 20:19
No problem makes sense.. in that case you need to set session/cookies/tokens.. check this out: http://stackoverflow.com/questions/15626868/prevent-double-form-submit-using-tokens – CodeGodie Mar 23 '16 at 20:21

Stop form submit spamming via PHP script

1 Answers1