refresh causes double post

[Mark]

i'm using an html form to submit comments to a database. the form is on
the same page where the comments are being displayed. if you hit
submit, your comment appears as it should, but then if you hit refresh
there is a duplicate post. how might i fix this?

[Mark]

relevant code:

// submit comment
if( $name && $comment )
{
$query = "INSERT INTO comments (name,email,com ment,id) VALUES
('$name','$emai l','$comment',$ id)";
mysql_query($qu ery,$db);
}
else if( $submit )
{
echo 'missing fields';
}

// display comments
$result = mysql_query("SE LECT * FROM comments WHERE id='$id' ORDER BY
timestamp DESC");
$num = mysql_numrows($ result);

for($i=0; $i<$num; $i++)
{
$name = mysql_result($r esult,$i,"name" );
$email = mysql_result($r esult,$i,"email ");
$comment = mysql_result($r esult,$i,"comme nt");

echo '<br />';
if( $email )
echo '<a href="mailto:'. $email.'">';
echo '<b>'.$name.': </b>';
if( $email )
echo '</a>';
echo '<br />'.$comment;
}

mysql_close();

// display form
echo '
<form action="?id='.$ id.'" method="POST">

<label for="name">Name </label>
<input name="name" type="text" /><br />
<label for="email">Ema il</label>
<input name="email" type="text" /><br />
<label for="comment">C omment</label>
<textarea name="comment"> </textarea><br />

<input name="submit" type="submit" value="Submit" />
</form>
';

[Erwin Moller]

Mark wrote:

i'm using an html form to submit comments to a database. the form is on
the same page where the comments are being displayed. if you hit
submit, your comment appears as it should, but then if you hit refresh
there is a duplicate post. how might i fix this?

Hi Mark,

That has more to do with the browser than php.

Look at your action-tag in your form.
(It is very stange in your case by the way)

If a form is submitted the browser expects a page as anser.
In most cases this is the page the receiving script of the form generates.

Now if you hit 'refresh' the browser assumes you want the same page
refreshed, the one that was produced as a result of your posting.

One simple way to 'fix' this (because nothing is wrong) is:
page1.php contains form
set the action to page1_process.p hp

page1_process.p hp
receives the form, does its stuff like databaseinserts .
Do not create ANY output.
End you script with something like this:

$result = urlencode("Than ks for posting!");
header ("Location: page1.php?resul t=".$result);
And in page1.php you could display the result if it exists in the
$_GET["result"].

Now the browser gets the news that page1.php is the one to be displayed.
Refreshing it will only refresh the page and not do a reposting.

If you set up all your scripts like this:
1) You never get that annoying problem again
2) You neatly seperate processing pages from contentrich pages, thus
avoiding long and bugprone scripts that do it 'all functionality at once'.
Regards,
Erwin Moller

[Peter Fox]

Following on from Mark's message. . .

relevant code:

// submit comment
if( $name && $comment )
{
$query = "INSERT INTO comments (name,email,com ment,id) VALUES
('$name','$ema il','$comment', $id)";
mysql_query($qu ery,$db);

You /have/ taken precautions to avoid SQL injection?

--
PETER FOX Not the same since the cardboard box company folded
pe******@eminen t.demon.co.uk.n ot.this.bit.no. html
2 Tees Close, Witham, Essex.
Gravity beer in Essex <http://www.eminent.dem on.co.uk>

[noone]

Erwin Moller wrote:

Mark wrote:

i'm using an html form to submit comments to a database. the form is on
the same page where the comments are being displayed. if you hit
submit, your comment appears as it should, but then if you hit refresh
there is a duplicate post. how might i fix this?

Hi Mark,

That has more to do with the browser than php.

Look at your action-tag in your form.
(It is very stange in your case by the way)

If a form is submitted the browser expects a page as anser.
In most cases this is the page the receiving script of the form generates.

Now if you hit 'refresh' the browser assumes you want the same page
refreshed, the one that was produced as a result of your posting.

One simple way to 'fix' this (because nothing is wrong) is:
page1.php contains form
set the action to page1_process.p hp

page1_process.p hp
receives the form, does its stuff like databaseinserts .
Do not create ANY output.
End you script with something like this:

$result = urlencode("Than ks for posting!");
header ("Location: page1.php?resul t=".$result);
And in page1.php you could display the result if it exists in the
$_GET["result"].

Now the browser gets the news that page1.php is the one to be displayed.
Refreshing it will only refresh the page and not do a reposting.

If you set up all your scripts like this:
1) You never get that annoying problem again
2) You neatly seperate processing pages from contentrich pages, thus
avoiding long and bugprone scripts that do it 'all functionality at once'.
Regards,
Erwin Moller

Since you cannot prevent people from hitting the refresh button, you can
prevent the database from accepting it and generating an error to the
effect - you already did that.

you can create a primary key (PK) consisting of columns that you do not
want duplicated. I am assuming that a user name with a particular
email address can submit multiple comments with a unique id.

So your PK - or unique index depending on how you choose to resolve this
- would be name,email,id. If ID is not unique, then you would simple
let all 4 fields be a PK or have a unique index.

alter table comments add constraint pk_comments (name,email,com ment,id);

This will prevent duplicate values. You should always check the status
of all database statements for success/failure/warning and handle it in
your code.

[Mark]

Peter Fox wrote:

You /have/ taken precautions to avoid SQL injection?
Not yet, but thanks. I forgot what the term for that kind of attack
was, I'll do some research on it.

Erwin Moller wrote: One simple way to 'fix' this (because nothing is wrong) is:
page1.php contains form
set the action to page1_process.p hp

page1_process.p hp
receives the form, does its stuff like databaseinserts .
Do not create ANY output.
ah... excellent. this gets rid of that annoying "resend information"
message on refresh too.

noone wrote: alter table comments add constraint pk_comments (name,email,com ment,id);

so this will make it so that ALL those values together can't be
identical with any other comment?

i was wondering how I might do this. I figured out how do put "unique"
on a single column, but that doesn't help me much.

thanks a lot for your help guys! this is great.

[noone]

Mark wrote:

Peter Fox wrote:

You /have/ taken precautions to avoid SQL injection?

Not yet, but thanks. I forgot what the term for that kind of attack
was, I'll do some research on it.

Erwin Moller wrote:

One simple way to 'fix' this (because nothing is wrong) is:
page1.php contains form
set the action to page1_process.p hp

page1_process .php
receives the form, does its stuff like databaseinserts .
Do not create ANY output.

ah... excellent. this gets rid of that annoying "resend information"
message on refresh too.

noone wrote:

alter table comments add constraint pk_comments (name,email,com ment,id);

so this will make it so that ALL those values together can't be
identical with any other comment?

correct. the INSERT will fail.

i was wondering how I might do this. I figured out how do put "unique"
on a single column, but that doesn't help me much.

As I stated, you can also create unique indexes - the difference is the
error generated at the time of the failure - and how your code handles it.

Not knowing what other fields exist in this table makes the
recommendation of what to use a bit more difficult.


thanks a lot for your help guys! this is great.

any time.