Member Avatar for searchacar

Hi,
I have one issue on entering data into database twice. When user add some details on my website's form pages and click on submit then data is added correctly. But if someone hit refresh button again then it will add another duplicate entry.
Is there something in php i can do to avoid duplicate form entries. thanks

  • 3 Contributors
  • 2 Replies
  • 128 Views
  • 11 Hours Discussion Span
  • Latest Post Latest Post by JeniF

Dani AI

Generated

Short answer: combine the Post/Redirect/Get pattern, a single-use server-side form token, and a database uniqueness constraint. Each piece solves a different part of the problem: PRG prevents browser re-post-on-refresh, the token prevents accidental double submits from the same form, and the DB constraint defends against any client-side or race-condition bypass.

is correct that a database-enforced uniqueness rule is the last line of defense. is also on the right track with a session token, but avoid the old session_register API (deprecated); use modern session_start and a cryptographically strong token instead (see PHP session and random_bytes docs).

Example workflow and minimal PHP sketch:

// form page: create token
session_start();
if (empty($_SESSION['form_token'])) {
    $_SESSION['form_token'] = bin2hex(random_bytes(16));
}

// process page: verify token, insert, then redirect (PRG)
session_start();
if (!isset($_POST['form_token']) || !hash_equals($_SESSION['form_token'], $_POST['form_token'])) {
    exit('Invalid or duplicate submission');
}
unset($_SESSION['form_token']);

// use prepared statements (PDO) to insert; catch duplicate-key errors (SQLSTATE 23000)
// on success: header('Location: thankyou.php'); exit;

Notes and caution:

  • Always unset the token after successful verification so it is single-use. See hash_equals, random_bytes, and session_start on php.net.
  • Enforce uniqueness with a UNIQUE index in MySQL and handle duplicate-key errors server-side (SQLSTATE 23000) or use INSERT ... ON DUPLICATE KEY UPDATE carefully. See MySQL docs on unique indexes and duplicate-key handling.
  • Never rely solely on client-side checks. Use prepared statements to avoid SQL injection and always exit after a redirect.

References: PHP session_start and random_bytes (https://www.php.net/manual/en/function.session-start.php, https://www.php.net/manual/en/function.random-bytes.php), hash_equals (https://www.php.net/manual/en/function.hash-equals.php), session_register deprecation (), PDO error handling (https://www.php.net/manual/en/pdo.error-handling.php), MySQL unique/index and insert-on-duplicate docs (https://dev.mysql.com/doc/refman/8.0/en/create-index.html, https://dev.mysql.com/doc/refman/8.0/en/insert-on-duplicate.html).

Recommended Answers

All 2 Replies

Member Avatar for MitkOK

Hi.

You can set mysql fileds as "unique" and check if values exists in DB before inserting.


- Mitko Kostov

Member Avatar for JeniF

You can set a session for this as well. Within the headtags place code to start and register the session:

<?php
session_start();
if (!session_is_registered("nextValidSubmission")) {
session_register("nextValidSubmission");
}
if (isset($_POST['emailAddress']) && $_POST['submissionId'] == $_SESSION['nextValidSubmission']) {
} 
$_SESSION['nextValidSubmission'] = rand(1000000,9999999);
?>

Then within your form, place a hidden field:

<input type="hidden" value="<?php echo $_SESSION['nextValidSubmission'];?>" name="submissionId"> 
:icon_eek:
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.