How to prevent multiple inserts when submitting a form in PHP?

Question

Sometimes the user may press Enter twice, and the post is inserted twice.

Is there a solution to prevent this other than check if there is already a post with the same title and content?

Answer 1

There are several solutions to this problem:

1. Use Javascript to disable the form's submit button when it is posted. Downside to this is that this is ABSOLUTELY not a foolproof way. It's very easy to submit forms without actually clicking the button, and this would also not work for users with JavaScript disabled. I would definitely not recommend this method.

   Example:

   <script language="javascript"> <!--     function disableSubmitButton() {         // you may fill in the blanks :)     } --> </script> <form action="foo.php" method="post">     <input type="text" name="bar" />     <input type="submit" value="Save" onclick="disableSubmitButton();"> </form> 

2. Use PHP sessions to set a session variable (for example $_SESSION['posttimer']) to the current timestamp on post. Before actually processing the form in PHP, check if the $_SESSION['posttimer'] variable exists and check for a certain timestamp difference (IE: 2 seconds). This way, you can easily filter out double submits.

   Example:

   // form.html <form action="foo.php" method="post">     <input type="text" name="bar" />     <input type="submit" value="Save"> </form>  // foo.php if (isset($_POST) && !empty($_POST))  {     if (isset($_SESSION['posttimer']))     {         if ( (time() - $_SESSION['posttimer']) <= 2)         {             // less then 2 seconds since last post         }         else         {             // more than 2 seconds since last post         }     }     $_SESSION['posttimer'] = time(); } 

3. Include a unique token on each POST. In this case, you would also set a session variable to the token you want to include and then render the token in the form. Once the form is submitted, you re-generate the token. When the submitted token does not match the token in your session, the form has been re-submitted and should be declared invalid.

   Example:

   // form.php <?php     // obviously this can be anything you want, as long as it is unique     $_SESSION['token'] = md5(session_id() . time()); ?> <form action="foo.php" method="post">     <input type="hidden" name="token" value="<?php echo $_SESSION['token'] ?>" />     <input type="text" name="bar" />     <input type="submit" value="Save" /> </form>  // foo.php if (isset($_SESSION['token'])) {     if (isset($_POST['token']))     {         if ($_POST['token'] != $_SESSION['token'])         {             // double submit         }     } }