PHP $_POST form to expire if page reloaded

Question

I have a form (for A) that redirects to another form (form B).

When the user is redirected to form B, the if $_POST is set, an email function is triggered. This is a problem b/c if the user reloads the page, this email is sent again.

I would like to stop sending the email if the page is realoaded.

Hence, I included a field in form A, type=hidden with value=send, and when the email (form B) is sent I unset this field, but if I reaload the page the email is sent anyway.

if(isset($_POST['emailtrigger'])){

            emailfunction();        
    unset($_POST['emailtrigger']);


  }

How could I cue to the page that after the email has been sent, if page (form B) is reloaded, to skip email function?

Thank you

This is what [303 redirects](http://en.wikipedia.org/wiki/HTTP_303) are for... — DaveRandom, Jan 09 '12 at 22:24
You cant unset them like that, because they are sent from the client. PHP is a server side language. You could use a PHP session to determine whether the page has been resent. — craig1231, Jan 09 '12 at 22:26
@DaveRandom: You see a lot of answers that should have been comments, but this is a comment that should have been an answer. :) — netcoder, Jan 09 '12 at 22:41

score 3 · Accepted Answer · answered Jan 09 '12 at 22:39

3

If you want to avoid redirects, or want to protect yourself against users that press "Back" and resubmit the form after redirect, simple solution would be to add a hidden field with a random value, generated when form if loaded. After form submit, just write this field value into session data. Then, if user submits same form data you will compare random field and what is written in the session data. If there's that value - you don't process the form data.

answered Jan 09 '12 at 22:39

Ranty

3,333
3
22
24

1

I implemented creating a session, setting a session variable within within if ($_POST && session['thevariable'] != '1'){ email... $_session['thevariable'] = 1; } When page is reloaded, $_session['thevariable'] == 1, and so email is not triggered THANK YOU – IberoMedia Jan 18 '12 at 05:04

score 1 · Answer 2 · answered Jan 09 '12 at 22:25

1

This is obviously done by redirecting to the same page after processing your form. So if your form is processed by script form.php, then after sending email you should do redirect:

header('location: form.php');

This is invisible for users and after reloading no $_POST values are sent again.

answered Jan 09 '12 at 22:25

Peter Krejci

3,182
6
31
49

I need $_POST through out form B page, so I need to keep $_POST live. I assume your response assumes that I get rid of $_POST in the form.php and the redirect to form B? – IberoMedia Jan 09 '12 at 22:29
+1 for the use of the word "obviously" - actually laughed when I read that. – Kai Qing Jan 09 '12 at 22:30
@ibero - there are a number of ways to apply the basic principle though - the idea of redirect is to avoid triggering the isset post call - depending on how you set that up. You can use sessions to contain form 1's data, hidden fields, etc. The options are numerous. You can even just set a session var for number of times the email was sent and prevent it if it is over 1. Your choice. – Kai Qing Jan 09 '12 at 22:36
@IberoMedia so just use redirect in form B like this: `form A->form B->send email->redirect to form B` – Peter Krejci Jan 09 '12 at 22:37
@Kai Qing I wish you had written this as an answer. I ultimatelly implemented creating a session, setting a session variable within within if ($_POST && session['thevariable'] != '1'){ email... $_session['thevariable'] = 1; } Thank you – IberoMedia Jan 18 '12 at 05:03
Either way the suggestions here are usefult o anyone finding this answer. If the selected answer helps you then it is ok to just leave it as the answer. If you want me to rewrite my comment as an answer to select it then I can but I don't know if it will help people who find this question useful any more than the current answers do. – Kai Qing Jan 18 '12 at 21:12

score 1 · Answer 3 · answered Jan 09 '12 at 22:34

Once A did it's job, continue with form B, $_POST would be available.

Once B is done, execute

header('location: formConfirm.php');
exit;

The script formConfirm.php would print the confirmation message, nothing else. Especially, it shouldn't update the DB or send email.

More general, you might implement a generic formConfirm.php, which you always use to present confirmations - e.g. somehow passing the actual confirmation message.

PHP $_POST form to expire if page reloaded

3 Answers3

Linked