0

I'm developing a website (based on wordpress if that matters) that has a cart and order checkout. On order checkout the script saves the order inside the database, with a mechanism to prevent multiple insertions of the same order, but only works half.

The steps:

  1. Generating a form with an input field that contains a token which I use later to check if the form was already submitted.
  2. User submits the form to a separate page that handles the logic. Here I check if the form token exists inside _SESSION. If exists then unset it and proceed. If doesn't exist then the form is already submitted.
  3. Check if order is already saved based on a boolean inside the order object (which I keep inside session between pages). If the saved flag is not raised then save it inside db.

As you can see I have a double check, which WORKS if I submit the form and wait about 1 sec. The problem is when I crazy hammer that submit button 6-7 times in 1 second (which user could do). The order is inserted multiple times.

I think this is due to some server latency or the fact that I use a plugin for enabling _SESSION inside wordpress, which saves everything inside the DB. So when I save/access a session variable there is a DB call with some latency.

Is there a way to prevent firing multiple instances of the script when the user submits the form? Or any other solution? I don't really want to use javascript to disable the button if possible, the user could have it disabled.

Funk Forty Niner
  • 74,450
  • 15
  • 68
  • 141
SebaSbs
  • 343
  • 1
  • 2
  • 11
  • u can add an interval check on the server, so only one order is saved every 1 second from the same ip, this is also call request throttling – ctf0 Nov 22 '19 at 22:14
  • Sessions should work. Have you see/tried [this Q&A?](https://stackoverflow.com/q/4614052/1415724). – Funk Forty Niner Nov 22 '19 at 22:28
  • 1
    You could also try a JS solution along with sessions and update the database with a boolean flag for a unique id/column. – Funk Forty Niner Nov 22 '19 at 22:30
  • I think this would be the most viable options you have: https://stackoverflow.com/questions/2133964/how-to-prevent-multiple-inserts-when-submitting-a-form-in-php – magicbyt3 Nov 22 '19 at 23:28

0 Answers0