This is more of a critique of the code rather than a solution to the problem:
$_SESSION['result'] = []; //Clear it in case there's an old value here.
if (isset($_POST['boxdest']) && is_array($_POST['boxdest']) && !empty($_POST['boxdest'])) { //Merged condition
$destroydata = explode(',', $_POST['boxdest'][0]); //Split was deprecated
$result = array_filter($destroydata);
if (empty($result) {
$boxdesterror = '<span style="font-weight:bold;font-size:12px;color: #ff0000;">' . 'BOX DESTRUCTION ERROR! ' . '</span>' . '<span style="font-weight:normal;color: #000;background-color:#ffa;">' . 'You must enter a box for destruction' . '</span>';
echo "<script language=\"JavaScript\">\n";
echo 'alert("BOX DESTRUCTION ERROR:\nYou must enter a box for destruction.");';
echo "</script>";
echo $boxdesterror;
} else {
echo 'You wish to destroy ' . count($result) . ' box(es): ' . '<div style="word-wrap:break-word;white-space: pre-wrap;overflow:auto !important;height: 100px; width: 250px; border: 1px solid #666; background-color: #fff; padding: 4px;">' . '<span style="font-weight:bold;color: #000;">' . implode(', ', $boxdest) . '</span>' . '</div>' . '<p />';
$_SESSION['result'] = $result; //Did you really need both?
$flag = 1;
}
}
This should be the same results. I don't see why a resource would pop up from nowhere though.