Refresh problem and posts

[John]

I have a problem with refresh.

I have a contact form that sends an email when the submit button is
pressed. I have a hidden variable and the code for emailing is only
executed if the variable is set. The variable is cleared at the end of
the code. All works as expected unless the REFRESH button is pressed
by the user in which case the script is executed and the emails are
sent once more. Debugging shows the test variable is set again even
though it was unset before exiting on the previous run. How can this
be?

I know there are some things I could do like using database entries or
cookies to hold the variable or even jump to another page which I do
not want to do.

There must be a simple explanation and hopefully solution to this.

Thanks

--
John

[www.douglassdavis.com]

John wrote:

I have a problem with refresh.

I have a contact form that sends an email when the submit button is
pressed. I have a hidden variable and the code for emailing is only
executed if the variable is set. The variable is cleared at the end of
the code. All works as expected unless the REFRESH button is pressed
by the user in which case the script is executed and the emails are
sent once more. Debugging shows the test variable is set again even
though it was unset before exiting on the previous run. How can this
be?

I know there are some things I could do like using database entries or
cookies to hold the variable or even jump to another page which I do
not want to do.

There must be a simple explanation and hopefully solution to this.

the browser actually saves all of those POST variables... If the user
requests the page again, the way the browser displays the same page, is
to resend the same variables.

there are several solutions. one is this:

1. when form submitted via post, send the email, then
2. imediately redirect to the same page, maybe with a querystring
paramater of emailsent=1 and username=Joe Public.

When the page is displayed with the GET emailsent parameter set to 1,
then you can say "Thanks you Joe Public for sending the email." or
whatever.

[Gordon Burditt]

>I have a contact form that sends an email when the submit button is

pressed. I have a hidden variable
What kind of variable? HTML form? Javascript? PHP?
and the code for emailing is only
executed if the variable is set.
What kind of code? PHP?
The variable is cleared at the end of
the code.
Resetting a $_GET or $_POST variable is meaningless after the PHP
code finishes executing. If the page is submitted again, it
gets its new value from the page. Ordinary PHP variables vanish
when the code exits.

I'm not so sure Javascript variables retain their values in this
situation either.

$_SESSION would retain its value if you properly start up a session
at the beginning of the PHP code.
All works as expected unless the REFRESH button is pressed
by the user in which case the script is executed and the emails are
sent once more. Debugging shows the test variable is set again even
though it was unset before exiting on the previous run. How can this
be?

I know there are some things I could do like using database entries or
cookies to hold the variable or even jump to another page which I do
not want to do.
I doubt cookies would help in this situation, except for their
use in establishing a session.
There must be a simple explanation and hopefully solution to this.

Database and/or session variables.

Gordon L. Burditt

[ZeldorBlat]

Gordon is right...you need to keep some sort of state -- either in a
session variable or cookie.

What I usually do (and believe me, it isn't perfect) is to set some
random identifier at the top of the page. Call it $curPageId.
Whenever I draw a post form, I include the value of curPageId as a
hidden post parameter. At the top of the next page, set another
session variable called $prevPageId to the value of $curPageId, and set
a new random value for $curPageId. Then, before processing the form,
check that the value of $prevPageId from the session is the same as the
value of the form variable that was submitted. If it is, you can
process the form. If they are different, you know that the form was
refreshed.

Of course, if you want to store the value in a cookie instead of a
session, that's fine, too -- although I tend to prefer the session.

As I said before, the approach isn't perfect. You can, of course, run
into problems with multiple windows or tabs viewing the same pages.

[Peter Fox]

Following on from John's message. . .

I have a problem with refresh.

You have to understand that scripting web pages is like sending letters
in the mail between people. It isn't like a phone conversation. In
fact it is more like a coupon in a newspaper which you cut out and send
for your free starter bag of toenail clippings or whatever. There is
nothing to stop somebody sending the form twice. It is up to you in
your office (ie server-side) to weed out the double clickers and robots.

OK so you don't want to be bothered and don't want to send them to
another page[1] - Sorry chum, it goes with the territory. Anyway, it
isn't difficult and _even after_ you have tested your pages with the
most daft (not to mention malicious) input you will still find odd ways
in which it gets abused.

Have a look at the posts to this ng in the last 10 days for the sorts of
things to look out for. At the very least you will want to keep a log
of what's been going on so you can spot abuse. If your site is
commercial then FX:Sharp intake of breath. Does Blogg's the builders
really want to be the subject of an investigation for sending out
pictures of 10 year old girls? - Yes, it could happen there are bots
looking for innocent sites that haven't got a clue they are being used
to channel spam/porn/u-name-it.

[1] Actually not necessary but it is REALLY IMPORTANT to tell somebody
that something has happened as a result of the clicks they've just made.

--
PETER FOX Not the same since the e-commerce business came to a .
pe******@eminent.demon.co.uk.not.this.bit.no.html
2 Tees Close, Witham, Essex.
Gravity beer in Essex <http://www.eminent.demon.co.uk>

[John]

On Sun, 18 Sep 2005 18:14:20 +0100, John <yuiouio@dfghfgh> wrote:

I have a problem with refresh.

I have a contact form that sends an email when the submit button is
pressed. I have a hidden variable and the code for emailing is only
executed if the variable is set. The variable is cleared at the end of
the code. All works as expected unless the REFRESH button is pressed
by the user in which case the script is executed and the emails are
sent once more. Debugging shows the test variable is set again even
though it was unset before exiting on the previous run. How can this
be?

I know there are some things I could do like using database entries or
cookies to hold the variable or even jump to another page which I do
not want to do.

There must be a simple explanation and hopefully solution to this.

Thanks as ever for a great response and new ideas.

I did as Douglas suggested and reloaded the page with a GET which I
could test for. It also provided a thank you page which can then be
refreshed with no repercussions as Peter advised.

BTW its not about not being bothered but finding elegant solutions.

My thanks to a great group once again.

--
John