How to prevent multiple inserts when submitting a form in PHP?

Sometimes the user may press Enter twice, and the post is inserted twice.

Is there a solution to prevent this other开发者_高级运维 than check if there is already a post with the same title and content?

There are several solutions to this problem:

1. Use Javascript to disable the form's submit button when it is posted. Downside to this is that this is ABSOLUTELY not a foolproof way. It's very easy to submit forms without actually clicking the button, and this would also not work for users with JavaScript disabled. I would definitely not recommend this method.

   Example:

   <script language="javascript">
   <!--
       function disableSubmitButton() {
           // you may fill in the blanks :)
       }
   -->
   </script>
   <form action="foo.php" method="post">
       <input type="text" name="bar" />
       <input type="submit" value="Save" onclick="disableSubmitButton();">
   </form>
   

2. Use PHP sessions to set a session variable (for example $_SESSION['posttimer']) to the current timestamp on post. Before actually processing the form in PHP, check if the $_SESSION['posttimer'] variable exists and check for a certain timestamp difference (IE: 2 seconds). This way, you can easily filter out double submits.

   Example:

   // form.html
   <form action="foo.php" method="post">
       <input type="text" name="bar" />
       <input type="submit" value="Save">
   </form>
   
   // foo.php
   if (isset($_POST) && !empty($_POST)) 
   {
       if (isset($_SESSION['posttimer']))
       {
           if ( (time() - $_SESSION['posttimer']) <= 2)
           {
               // less then 2 seconds since last post
           }
           else
           {
               // more than 2 seconds since last post
           }
       }
       $_SESSION['posttimer'] = time();
   }
   

3. Include a unique token on each POST. In this case, you would also set a session variable to the token you want to include and then render the token in the form. Once the form is submitted, you re-generate the token. When the submitted token does not match the token in your session, the form has been re-submitted and should be declared invalid.

   Example:

   // form.php
   <?php
       // obviously this can be anything you want, as long as it is unique
       $_SESSION['token'] = md5(session_id() . time());
   ?>
   <form action="foo.php" method="post">
       <input type="hidden" name="token" value="<?php echo $_SESSION['token'] ?>" />
       <input type="text" name="bar" />
       <input type="submit" value="Save" />
   </form>
   
   // foo.php
   if (isset($_SESSION['token']))
   {
       if (isset($_POST['token']))
       {
           if ($_POST['token'] != $_SESSION['token'])
           {
               // double submit
           }
       }
   }
   

Use a unique token with the post, so that each post/postback is only handled once.

Disabling the submit button is not a very good solution since people could have javascript turned off, or doing other weird things. Client side validation is a good start, but should always be backed up with server side handling as well.

Generate a unique, one-time use key to submit with the form.

Relying on Javascript is a bad idea because it may have been disabled in the client by the user. With the key scheme, when the submit is received by the server, submission for that key can be locked. You can respond to duplicate submits however you like.

For this approach to work, keys must be unique and very difficult to predict. Otherwise some forms could be locked due to key collisions. So you don't have to track keys for every form submission and avoid collisions, keys should expire with that user's session. The other thing to watch out for is if malicious users are able to predict the key, your code may be vulnerable to some kind of hijacking or DOS exploit.

Prevent Duplicate Form Submission shows a way of doing it without javascript.

Disable the submit button using Javascript once the form gets submitted (onsubmit).

Note that if the user has disabled Javascript, they can still submit twice. Whether or not this happens often enough to justify also checking in your code (as you suggested in your question) is up to you.

Alternatively, use one-time form keys.

I use this:

$form_token = $_SESSION['form_token'] = md5(uniqid());

send $form_token with the form, then...

I check the form_token:

if($_SESSION['form_token'] != $_POST['form_token']) {
   echo 'Error';
}

disable the submit button once the user has submitted the form, using JavaScript. That is what, for example, StackOverflow uses when you answer a question.

For example

<input type="submit" onclick="this.disabled=true" />

Pressing submit twice quite rarely results in multiple inserts, but if you want a dead-simple sollution, use

onsubmit="document.getElementById('submit').disabled = true"

in the form tag, provided you give your submit button id="submit"

Use a JavaScript to disable the button as soon as it is clicked.

onclick="this.disabled=true;forms[0].submit();"

Another way to create a confirmation page where user can finally press the submit button. It might reduce the possibilities of this kind.

I'm doing the following on the action.php

if($_SESSION && isset($_SESSION['already_submitted'])) {

  # If already submitted just redirect to thank you page

} else {

    # If first submit then assign session value and process the form
    $_SESSION['already_submitted'] = true;

    # Process form

}

Note: Always initiate your sessions in the header using session_start();

Aron Rotteveel's Include a unique token on each POST worked for me. However, my form still submits when a user refreshes the page (F5). I managed to solve this by adding a reset:

            // reset session token
            $_SESSION['token'] = md5( $_POST['token'] . time() );

my final scripts goes like:

if (isset($_SESSION['token'])) {
    if (isset($_POST['token'])) {
        if ($_POST['token'] != $_SESSION['token']) {
            echo '<h3>Oops! You already submitted this request.</h3>';
        } else {
            // process form
            // reset session token
            $_SESSION['token'] = md5( $_POST['token'] . time() );
        }
    } else {
        echo 'post token not set';
        $_SESSION['token'] = md5( $somevariable . time() );
    }
}

oh! don't forget to add session_start(); before <!DOCTYPE>

I am a PHP newbie so please correct me if you find irregularities.

Use JavaScript to stop it from sending

$(document).ready(function() {
  $('#postHideBtn').show();
  $('#postHideBtn').click(function() {
    $('#postHideBtn').hide();
  });
});

<script src="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.min.js"></script>

<form action="foo.php" method="post">
  <input type="text" name="bar" />
  <input type="submit" value="Save" id="postHideBtn" />
</form>