Every time you refresh the page, an e-mail is sent - php

Question

I have a problem with my code. I'm creating a contact form. I don't know about php, I'm learning and I have a problem. What's wrong with this code, every time I refresh the page an email was sent and you I see "Confirm form resubmission" information which is annoying. Can you help me solve these problems?
<?php
$show = "";
if(isset($_POST['submit'])){
if(filter_var($_POST['email'],FILTER_VALIDATE_EMAIL)){
$name = $_POST['name'];
$email = $_POST['email'];
$subject = $_POST['subject'];
$message = $_POST['message'].".\n\n"."Sent from contact form.";
$to = "Test <test#justtest.com>";
$headers = "From: ".$name."<".$email.">";
mail($to,$subject,$message,$headers);
$show = "<p class='success'>Your message was sent.</p>";
}
}
?>
<form action="index.php" method="POST" class="form">
<input type="text" name="name" placeholder="Name" required>
<input type="email" name="email" placeholder="Your email" required>
<input type="text" name="subject" placeholder="Subject">
<textarea name="message" rows="5" placeholder="Message" required></textarea>
<button type="submit" name="submit">Send</button>
<?php echo $show;?>
</form>

Answer 1

Generally the approach to solve the "Confirm form resubmission" is to redirect after processing a form post. So instead of just re-rendering the page, you'd do something like this:
if(isset($_POST['submit'])){
if(filter_var($_POST['email'],FILTER_VALIDATE_EMAIL)){
// the rest of the code you already have, then...
header("Location:index.html");
die();
}
}
You can of course replace "index.html" with any page you like, in this case I imagine it would be the current page.
What this does is instruct the browser to not render the current response (if there even is anything in the response) but instead to issue a new GET request to the specified page in the header. So if the user then later refreshes that page, they're only refreshing the GET request and not re-submitting the form.
Edit: You can also still show your message to the user:
$show = "<p class='success'>Your message was sent.</p>";
What you would do in this case is not show the message where you currently have it, but instead include it as a separate operation on the page invoked by a query string parameter. So you might have something like this:
$show = "";
if(isset($_GET['sent'])){
$show = "<p class='success'>Your message was sent.</p>";
}
if(isset($_POST['submit'])){
if(filter_var($_POST['email'],FILTER_VALIDATE_EMAIL)){
// unchanged code not shown here for brevity
mail($to,$subject,$message,$headers);
header("Location:index.html?sent=true");
die();
}
}
And later in the page you can output the message like you already do:
<?php echo $show;?>
The way this message gets triggered is by the query string paramter used in the redirect:
header("Location:index.html?sent=true");
Which means that technically any time somebody goes to your page with sent=true manually they would see the message without actually sending the email. But if users are tinkering like that then the behavior they get is the behavior they should expect. If you're keen on preventing this otherwise inoccuous tinkering then you could also store a flag in $_SESSION rather than in the query string. That's up to you.

Answer 2

when you submit the form, a post request is sent, and so by reloading the page, the same form is been resubmitted over and over.
In order to solve this, you just need to redirect the user to the same page, instead of returning the page itself, so you need to add
header("Location: http://$_SERVER[HTTP_HOST]$_SERVER[REQUEST_URI]";); // or paste here the url of the page where the form is located
die();
after
mail($to,$subject,$message,$headers);
So you ends up with this:
<?php
$show = "";
if(isset($_POST['submit'])){
if(filter_var($_POST['email'],FILTER_VALIDATE_EMAIL)){
$name = $_POST['name'];
$email = $_POST['email'];
$subject = $_POST['subject'];
$message = $_POST['message'].".\n\n"."Sent from contact form.";
$to = "Test <test#justtest.com>";
$headers = "From: ".$name."<".$email.">";
mail($to,$subject,$message,$headers);
header("Location: http://$_SERVER[HTTP_HOST]$_SERVER[REQUEST_URI]";); // or paste here the url of the page where the form is located
die();
$show = "<p class='success'>Your message was sent.</p>";
}
}
?>
<form action="index.php" method="POST" class="form">
<input type="text" name="name" placeholder="Name" required>
<input type="email" name="email" placeholder="Your email" required>
<input type="text" name="subject" placeholder="Subject">
<textarea name="message" rows="5" placeholder="Message" required></textarea>
<button type="submit" name="submit">Send</button>
<?php echo $show;?>
</form>
php html
In order to keep the <p class='success'>Your message was sent.</p> you can use GET parameters:
<?php
$show = "";
if(isset($_POST['submit'])){
if(filter_var($_POST['email'],FILTER_VALIDATE_EMAIL)){
$name = $_POST['name'];
$email = $_POST['email'];
$subject = $_POST['subject'];
$message = $_POST['message'].".\n\n"."Sent from contact form.";
$to = "Test <test#justtest.com>";
$headers = "From: ".$name."<".$email.">";
mail($to,$subject,$message,$headers);
header("Location: http://$_SERVER[HTTP_HOST]$_SERVER[REQUEST_URI]?redirect=true";); // or paste here the url of the page where the form is located
die();
} else if(isset($_GET['redirect'])){
$show = "<p class='success'>Your message was sent.</p>";
}
}
?>
<form action="index.php" method="POST" class="form">
<input type="text" name="name" placeholder="Name" required>
<input type="email" name="email" placeholder="Your email" required>
<input type="text" name="subject" placeholder="Subject">
<textarea name="message" rows="5" placeholder="Message" required></textarea>
<button type="submit" name="submit">Send</button>
<?php echo $show;?>
</form>
php html