Posting Twice to MySql Database (On Occasion) - php

Question

I have a script that posts form responses to a MySQL Database. However, it is on occasion posting twice to the table with seconds between each row.
Here is the handling script:
if (isset($_POST['SignIn']))
{
$Name = $_POST['Name'];
$Sleep = $_POST['Sleep'];
$Soreness = $_POST['Soreness'];
$Fatigue = $_POST['Fatigue'];
$Energy = $_POST['Energy'];
$Stress = $_POST['Stress'];
$Total = $Sleep + $Soreness + $Fatigue + $Energy + $Stress;
$Comments = $_POST['Comments'];
$sql = "
INSERT INTO
YDP_Wellbeing (Name, Sleep, Soreness, Fatigue, Energy, Stress, Total, Comments)
VALUES
('$Name', $Sleep, $Soreness, $Fatigue, $Energy, $Stress, $Total, '$Comments')";
if (mysqli_query($con, $sql))
{
$_SESSION['alert-type'] = 'success';
$_SESSION['alert-head'] = 'Welcome!';
$_SESSION['alert-body'] = 'Thank You <strong>' . $Name . '</strong> You\'re Response Has Been Submitted.';
header("location: index.php");
}
else
{
echo "Failed: " . mysqli_error($con);
}
}
Sometimes it posts once, other times it posts twice, so the issue is intermittent it would appear?

Answer 1

The most likely cause of the inconsistent behavior is the failure to stop the script after the redirect. Without adding die() or exit(), the script will continue to execute.
Since you've enclosed the section in an if clause that tests for a POST submission, I assume that if it fails the test it will present a form to be submitted. Since the script fails to terminate after the redirect, it will print the form again (and may or may not redirect).
Therefore what is likely happening is your user is submitting the form; and then upon seeing the same form presented after submission either
goes on his merry way,
resubmits the form, or
attempts to press the back button and resubmits the form accidentally

Answer 2

Your code is vulnerable to the followings Attacks
1.) sql injection Attack as you passed variable directly into sql queries. I have mitigated it using prepared statements
2.) Html Injections and XSS attack: you will need to ensure sanitization for form inputs. i used intval() for integers and strip_tags() for strings assuming that
you want to strip out dangerous html.
3.) session fixation attack. I also eliminate that using session _regenerate_id()
Here is your code Re written
<?php
$servername = "localhost";
$username = "db username goes here";
$pass = "your db password here";
$db_name = "your db name here";
// Create connection
$conn = new mysqli($servername, $username, $pass, $db_name);
// Check connection
if ($conn->connect_error) {
echo "Connection to db failed";
}
if(isset($_POST['SignIn'])) {
$Name = strip_tags($_POST['Name']);
$Sleep = intval($_POST['Sleep']);
$Soreness = intval($_POST['Soreness']);
$Fatigue = intval($_POST['Fatigue']);
$Energy = intval($_POST['Energy']);
$Stress = intval($_POST['Stress']);
$Total = $Sleep + $Soreness + $Fatigue + $Energy + $Stress;
$Comments = strip_tags($_POST['Comments']);
// prepare your data
// i stands for integers and s stands for string
$stmt = $conn->prepare("INSERT INTO YDP_Wellbeing (Name, Sleep, Soreness, Fatigue, Energy, Stress, Total, Comments) VALUES (?, ?, ?, ?, ?, ?, ?, ?)");
$stmt->bind_param("siiiiiis", $Name,$Sleep,$Soreness,$Fatigue,$Energy,$Stress,$Total,$Comments);
$stmt->execute();
if($stmt){
echo "data inserted successfully";
// create session
session_start();
// prevents session fixation attacks using session regenerate id
session_regenerate_id();
//
$_SESSION['alert-type'] = 'success';
$_SESSION['alert-head'] = 'Welcome!';
$_SESSION['alert-body'] = 'Thank You <strong>' . $Name . '</strong> You\'re Response Has Been Submitted.';
header("location: index.php");
}else{
echo "data insertion failed";
}
}
$stmt->close();
$conn->close();
?>