Member Avatar for Greg_11

I have a fillin form , which has a submit button. In order to get to the fillin form, the user has already been authenticated and a session has been created, and variables have been added to the session.

In order to process the information, I have another 'insUpSel.php' file which does two things:

  1. populates a MSSQL database via a stored procedure with the contents of the session
  2. retrieves the results from the MS SQL table and populates an HTML table with multiuple result rows.

I want to prevent users from running the 'insUpSel.php' form manually and if they do force users back to the login page.

Is there a way, where I can update a variable before the processing the fillin form data?

ie. $submitted = true   (on fillin form)
then on the insupsel.php 
i check if $submitted = true
- IF TRUE, I set it back to false and continue processing the data
- IF FALSE, i force the user back to the login page

Many thanks

  • 2 Contributors
  • 2 Replies
  • 266 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by Greg_11

Dani AI

Generated

Good direction from both and — combine session checks with a single‑use server token and a Post/Redirect/Get flow to stop manual hits and duplicate inserts on refresh. Relying on a flag set when the page loads (like marking $inserted true on arrival) is brittle: it can be lost, reused, or bypassed. Instead, create a per‑form nonce, validate it server‑side, unset it after use, and then redirect to a results page.

Example: generate a nonce and place it in the form.

session_start();
if (empty($_SESSION['form_nonce'])) {
    $_SESSION['form_nonce'] = bin2hex(random_bytes(32));
}
<!-- put this hidden input into the HTML form -->
<input type="hidden" name="form_nonce" value="<?php echo $_SESSION['form_nonce']; ?>">

Validate and use PRG on processing:

session_start();
if ($_SERVER['REQUEST_METHOD'] !== 'POST') { header('Location: login.php'); exit; }
if (empty($_POST['form_nonce']) || !hash_equals($_SESSION['form_nonce'], $_POST['form_nonce'])) {
    header('Location: login.php'); exit;
}
unset($_SESSION['form_nonce']);   // single use
// run prepared statement insert here
header('Location: results.php'); exit;   // prevents refresh reposts

Add a DB-side safeguard: enforce a UNIQUE constraint on whatever combination of columns would make an insert a duplicate (user id + business key or timestamp). That way even if a form is posted twice, the database prevents duplicate logical records. Also always use prepared statements and transactions.

Troubleshooting notes: call session_start() on every page, never output before header() redirects, and set the nonce only after showing the form (unset it immediately after successful processing). This approach addresses both manual access and refresh-caused duplicates while keeping checks server‑side (as recommended) and avoiding fragile client/state flags.

Recommended Answers

All 2 Replies

Member Avatar for Dani

You mention that in order to get to the form, the user has already been authenticated and variables have been added to the session. If that's the case, can't the beginning of insUpSel.php simply check whether the proper session variables exist, and if not, do an HTTP header redirect to the login page?

On insupsel.php, you can do any of the following:

// 'submitted' field with specific value was passed into form
if (isset($_POST['submitted']) AND $_POST['submitted'] == 'value') { ... }

// 'user_id' cookie with specific value is set
if (isset($_COOKIE['user_id']) AND $_COOKIE['submitted'] == 'value') { ... }

// 'session_var' session variable with specific value exists
if (isset($_SESSION['session_var']) AND $_SESSION['submitted'] == 'value') { ... }
Member Avatar for Greg_11

I was doing that.. but If a user refreshes that page it inserts a new record whenever they press refresh.

But that got me to remeber to add a variable to set once I get to the page.

So, it loads, sets a variable of '$inserted' to true, and when you try again if that variable is set, it returns to login.

Again, some of my questions may seem silly, but I am learning.

Love this community.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.