Posted by larry on 01/23/07 04:58

Ive taken care of similar using session variables,

when you intially enter the form a session with a unique ID of the form
is recorded
$_SESSION['formcheck'] = date("Ymdhis");
and is added as a hidden value for POST
<input="hidden" name="formcheck" value="<?php echo
$_SESSION['formcheck']; ?>">

When the form loops back the DB checks to make sure the session and the
POST data match, if not it will exit without continuing
// this is after some code filtered $_POST['formcheck'] into
$forrmcheck
if($formcheck != $_SESSION['formcheck'] ){
header("Location: ../formexit.php");
}

If the POST was successful you can go on to validate data and if ready
to save - save it , if not, fall back to some url in the header line.

Now, once the data is valid, the form data is recorded and the formid
session value is intentially changed (thus preventing the back button
from possibly re-posting the saved data.)

By using a time value, if for some reason you re-do the entry (enter a
form, skip out before final validation start a different form and then
do a page-back twice) the first unfinished form entry will have the old
POST formid data and won't match the SESSION formid either so it does
not let the user mes up there either.

[Back to original message]