Stop page from resending forms on refresh

Question

I'm wondering if there is a way to stop pages from resending html forms when you refresh.

Answer 1

You could send a Location header to a different URL in your script that is processing the form input. This new URL will be available for the browser without the need to send form data.

Answer 2

It is principally impossible to stop a client (browser) over which you have no control, from doing something. It is however possible - and in your case quite easy - to harden your app against this:

• When you show the form, create a random token, store it in the session and add it to the form as a hidden field
• When you receive the filled-out form, check the token against the session, if it doesn't match ignore the data, if it does match clear the token from the session and process the data

Any headers or other tricks may or may not work with browsers and people refreshing WITHOUT MALICE, but they definitly won't help against an attacker.

Answer 3

Use Post/Redirect/Get: http://en.wikipedia.org/wiki/Post/Redirect/Get

in PHP process the form in code, then instead of outputting anything put this header('Location: http://www.example.com/foo.php'); (obviously replacing the url) and do the display on another page. If you need to pass anything to that page then use the query string and $_GET[]

Answer 4

In my quest to solve this, I have been taking a bit of a different approach. In a self developed MVC environment I redirected the page twice. After making sure that the data is submitted to the database, I redirect it to

header("Location: http:// .... /redirect/blogcomment

This will call to my "redirect" class and the "blogcomment" method. Here it will get redirected again to the "referer".

 public function blogcomment() {
    $ref = $_SERVER['HTTP_REFERER'];
    $page = "Location: " . $ref . "#commentform";
    header($page);

}

This clears the POST array and by adding an anchor tag just in front of the form fields, I jump right back to that location. Of course I also gain a lot of freedom in customizing my redirect. So far it works like a charm.

Answer 5

I don't believe that there is a good way to do this. The way we have accomplished this in the past was to have a last_modified date and a minimum time between posts. If you haven't waited an hour say, the post would be rejected.

Answer 6

The only trick I know is to have the form submit return a page with a link that you click via javascript (meta refresh, whatever) to get you to a third page.

The idea being that the thing you end up refreshing when you hit F5 is the link page not the form submit page.

Answer 7

Double load... i.e. redirecting the page back to itself is bad practice. Try debugging an app that does this and it makes it much more awkward to realize thi is happening. For the love of god people, if you have to php submit a form, send it to a separate script first, then back if you want to remove a refresh sending the form again, much easier to debug!

Answer 8

try doing :

  unset( $_POST );

as last command.