PHP Double-Click Dilemma

Question

We have a problem with users double-clicking on buttons within our application to proceed from screen to screen.

We have implemented the ( onclick="this.disabled=true" ) on our buttons but we are convinced that it is not always sufficient to stop the fast-fingered double-click.

A simple example :-

Screen A has four input fields and a proceed button. When the proceed button is pressed, control is passed to server-side routine to validate info, set some session vars and call screen B.

What appears to happen occasionally is :-

On first click the server-side routine is called and begins validating info and setting session vars. Second-click takes control and again calls the server-side routine and begins validating info and setting session vars -> for us, the session vars are already set and this highlights the problem.

We have looked at tokens but don't think they will solve our problem.

We think that since every PHP application must be vulnerable to this double-click issue there has to be a standard method for resolving it but we have yet to find one.

If you have resolved this issue then we would be grateful if you would like to give us some insights into how we might overcome the problem.

* Thanks for the replies. Loic and Brian Nickel - hard to separate as both going for the token method via timestamp or GUID. We will have to go back and take another look at tokens. After discussion - as a preferred solution for us, we would go with the GUID token concept.

Answer 1

Since double click will basically submit the same form twice you can check the timestamp between two submits.

I'll take the example of stackoverflow because this site is awesome.

Let's say I vote this question up, server side, if my POST request is valid, then my POST request will be treated, and saved.

Then server side, before treating a request, they will check if this same form hasn't been posted in last few seconds (don't they?).

Anyway, my point is, give your forms a name, and when validated, put a timestamp in your users session so you can refuse their post of the same form given a defined amount of time.

Best of luck.