Unset post variables after form submission

Question

Is there a way to do the above? Basically, I don't want the form to be submitted again if someone presses refresh after already submitting the form once. In which case the browser asks, do you want to submit the form again. Will unset($_POST['username']) be of any help is this case?

Answer 1

The post/redirect/get is a good option as some posters have already mentioned.

One another way I can think of is to set a session in the dostuff.php page to indicate that the posting has already been done. Check this session var each time to see if the page is being loaded again because of a page refresh.

<?php
    session_start();
    if(isset($_SESSION['indicator'])) 
    {
        /*
        dont do anything because session indicator says 
        that the processing was already done..

        you might want to redirect to a new url here..          
        */
    }   
    else
    {

        /*
        first set session indicator so that subsequent 
        process requests will be ignored
        */
        $_SESSION['indicator'] = "processed"; 

        //process the request here..
    }
    ?>

In the page you redirect to, unset the session var so that the form can be resubmitted again afresh, making it a new post operation. This will allow new form posts but will prevent post operations due to page refresh

Answer 2

Use an intermediate page to do the operations and then redirect.

For example:

mypage.php --> the page with the form

dostuff.php --> receives the form data and makes operations, then redirects to any other page.

To do a redirect:
Put this line on the top of "dostuff.php": header("Location: mypage.php");

Answer 3

The problem you are facing above specifically can (and should) be solved with Post/Redirect/Get. Unsetting _POST on the php side would be ineffective since the problem is it is a separate request.

You also have to deal with double-clicking of submission buttons. You can solve this on the client side by disabling form submission after the button click, or by putting a random token in the form and storing that token in the session. The token will be accepted only once (session keeps track of whether the token has been posted).