2

I have created a user registration form using PHP/smarty. The form posts back to itself since I don't know of any reason not to do it this way. The problem here is that if the user refreshes the welcome page, the code will attempt to recreate the account. What is the best way to do this from both a user and security perspective?

if (isset($_POST['submit'])) {
        /* Create customer account */
        $smarty->display($welcome_template);

} else {
        $smarty->display($form_template);
}
Michelle
  • 2,155
  • 4
  • 26
  • 42
  • 2
    duplicate: http://stackoverflow.com/questions/3614197/php-prevent-form-from-being-submitted-twice and http://stackoverflow.com/questions/2133964/how-to-prevent-multiple-inserts-when-submitting-a-form-in-php – StasM Jan 12 '11 at 09:30
  • I've read both pages and neither answers my question – Michelle Jan 12 '11 at 10:51
  • Thanks Colonel, thats the least helpful comment I have received on stackoverflow. Im not here to waste anyone's time. – Michelle Jan 12 '11 at 11:16
  • Those links do not discuss anything to do with security. Just because this question is basic to you does that mean I can't ask it here, what kind of community do you think this is? – Michelle Jan 12 '11 at 13:32

3 Answers3

2

after the account has successfully been created, do a HTTP redirect and send them to a separate "success" page: http://en.wikipedia.org/wiki/Post/Redirect/Get

Stephen
  • 18,597
  • 4
  • 32
  • 33
0

I guess that is a reason to not do it this way. I think the standard solution is the Post/Redirect/Get pattern, which means: make the POST request and then redirect to a GET request to a confirmation page. That page can then be reloaded without any problem.

avdgaag
  • 41,292
  • 7
  • 29
  • 26
-1

the user may of course try to recreate their account at any time, so care must be taken for that.

For your needs, as post-action page shows confirmation, the easiest solution would be

//at end of post-action
echo '<script type="text/javascript">document.location = 'yoururl?cmd=confirm</script>';
die();

regards, //t

Teson
  • 6,644
  • 8
  • 46
  • 69