The problem i'm having is i keep on having to delete the cache or the form doesn't submit anything new. For example i typed in new data in the form and submitted and it wasn't inserted into mysql. I have to delete the cache first.
On submit.php is a form. done.php recieves $_POST variables from submit.php
. At the top of done.php i have session_cache_limiter('private_no_expire');. I have this so when the user presses the back button and returns to done.php, they won't get the page expired message.
I only added session_cache_limiter('private_no_expire'); to get rid of the page expired message. Is there alternative so when i user presses the back button they don't get the page expired message?... alternatively how do i solve this?
One alternative is to send a 301 redirect from the form processor back to submit.php after a failed or successful submission. This will prevent the prompt from appearing when the back button is used. It will skip over the submission process back to whatever page the user was on before that (generally submit.php).
You'll have to modify your logic in submit.php to handle this situation though. You wan't to re-populate the form fields with the user's previous entries and also be able to display any error message as to why the form didn't submit.
One way to handle this is to save all the form submissions and any error messages to the session and upon re-displaying submit.php, check to see if there is any form data in the session. If so, re-populate the form fields with the previous entries from the session and display any error messages from the session as well.
done.php
// validate form inputs here...
if (!$formIsValid) {
// save $_POST values to $_SESSION
// save any error message to $_SESSION
header('Location: /submit.php'); // redirect back to form
exit;
} else {
header('Location: /success.php'); // redirect to success page
exit;
}
Related
I'm using php
I have a process form for a comment page that when you click on submit, you will be redirected to the main page of the website
when I redirected to index.php from my processform.php, I want to see an alert in my index that "Your comment was saved!" (It needs that my index page understand that I'm coming from processform.php)
How can I do this?
you should use something like sessions.
set session on submit form. and on index.php check if session has set with the special key. then show the alert that you want.
on form submit and success :
// Start the session
session_start();
// Set session variables
$_SESSION["processform"] = "Your comment was saved!";
on index.php
if(isset($_SESSION["processform"]){
// do alert
}
I want to stop duplicate form submissions to my webpage. Everywhere I look for help, I see use a $_SESSION variable; but I fail to see how sessions and forms could possibly connect to each other outside the context of multiple user accounts.
Can someone show me exactly how this process works?
Edit: I don't want to stop the form being submitted multiple times; only to prevent resubmitting the form with the same values (on page refresh for example).
After the form is processed, the user should see a success/error message and then the form again.
Basically you need to use the unique SESSION value twice. Once somewhere in the form you are trying to submit and once stored in the $_SESSION variable. When the form is POSTED and both values are a match then we have a successful submission, when the form is POSTED but the values are different, no submission occurs.
I.e.:
somewhere on the top of your PHP page:
<?php
session_start(); // first line of your PHP page
$_SESSION['secretFormValue'] = isset($_SESSION["secretFormValue"]) ? $_SESSION["secretFormValue"] : md5(microtime()); // generate some unique session value
// assign submitted **secretFormValue** from your form to a local variable
$secretFormValue = isset($_POST["secretFormValue"])? filter_var($_POST["secretFormValue"], FILTER_SANITIZE_STRING) : '';
// check if the value is present in the **secretFormValue** variable
if($secretFormValue != '') {
// check if both values are the same
if($_SESSION["secretFormValue"] == $secretFormValue) {
// Process form values & submission ...
// add your own code...
unset($_SESSION["secretFormValue"]);
} else {
echo "Duplicate submission";
}
} else {
// do some other thing
}
somewhere below in your form:
<input type="hidden" name="secretFormValue" value"<?php echo $_SESSION['secretFormValue']; ?>">
***I did not test this so please comment in case there is a bug, thx.*
Edit:
If you need to prevent submit on page-refresh you may include clearing all the POST values on successful submit so the refresh would fail because of the empty POST i.e.:
unset($_POST); // place it right before unset($_SESSION["secretFormValue"]);
or
Include a redirect to a different page (i.e. Thank You Page) after submission i.e.:
header("Location:ThankYouPage.php"); // place it right after unset($_SESSION["secretFormValue"]);
or just found this one in other SO post:
https://en.wikipedia.org/wiki/Post/Redirect/Get
You could simply set a $_SESSION['submittedForm'] = true; variable once the form is submitted by that visitor. You could then check for that session data next time they visit the form page and either not show the form, or throw an error message if they try to submit it again.
I suggest an alternative approach. The problem you're trying to solve comes in two variants:
How can I prevent/detect a form from being submitted multiple times (usually accidentally) when the user refreshes the page after submitting?
How can I prevent the submission (or at least make it harder) of form data not coming from an actual form shown on my page?
The solution by Milan solves to both problems, but creates a problem on its own: if the user has the same page open in multiple tabs/windows (remember, they share the same session), this will break.
If you don't care about problem #2, it would be easier to do a "passive" approach, by keeping a list of form IDs in your session data that have already be submitted:
$formID = (isset($_POST["__form_id"]) ? $_POST["__form_id"] : false);
$submittedforms = (isset($_SESSION["submittedforms"]) ? $_SESSION["submittedforms"] : array());
// Check whether this form ID has been submitted before
if (in_array($formID, $submittedforms)) {
printf("Duplicate submission.");
exit;
}
// Store the ID of this form submission
$submittedforms[] = $formID;
$_SESSION["submittedforms"] = $submittedforms;
// Continue form processing...
If you need to prevent unauthorized (automated) form submission too, an active approach is needed. I would extend Milan's solution then to store multiple form IDs in your session data (in an array), one for each form generated; and then remove them one-by-one as they are submitted.
Okay. I have yet another easy problem which I can't solve. I am working with PHP and I am working on a form to be validated by PHP. I have validated the form in another page containing the same elements. That's the
<form name = "Order Form" action = "<?php echo htmlspecialchars($_SERVER["PHP_SELF"]);?>" method = "post">
but now the problem arises is that, when we have validated the form and there are no more errors, how to send the data for further registration in other pages. Assuming that Javascript is off I have to use this method. Help is very much appreciated.
You can use session to store some data for a short time such as registration process example:
<?php session_start();
if(noerror){
$_SESSION['username']=$username;
//similarly do for more
header("Location:next_page.php");
}
else{
//show error
}
Note: Alternatively You can also use hidden input but I will discourage that as for security purpose you need to re-validate that.
Update:
To check if an error has occurred or not no need to count them simply use an variable called $noerror and initialize it with TRUE and as soon as an error occurs set it to false then simply put it in if($noerror) at last.
If you want to display error message store them in an array like $error_log
example:
if(error_in_username){
$noerror=false;
$error_log['username']="Invalid Username";
}
Please refer to below link.
http://www.w3schools.com/php/php_form_url_email.asp
Hope this will solve your problem.
On your validation 'page' which should be a controller of sorts, if validation is successful, load the step2 page with the previous form data in hidden inputs.
OR
After successful validation of step1, save the data already into database (could be a temp table), and then proceed to step2 with the id of the entry you just saved. On submission of step2, you can merge the step2 data with the data of the entry that was saved in the database, and proceed to step3 if necessary. etc.
If you simply want to get to another page, the basic logic is:
if(validation_success)
{
header("Location: step2.php");
} else {
show_errors();
}
acitvity.php
//Form start
<form action=''>
</form>
//Form End
//Get POST Values
<?php
$_POST[''];
?>
//End
if i refresh the page after form is submitted, all the posted values are resubmitted, reason because all values are in browser so they are resubmitted. When i was searching solution for this, i got info that if the form & post operation done in separate php file then no more issue in posting values on refresh.
Is this the solutions? but now i have to do both in single file & POST values should not be submitted again on refresh.. is there any way to do this???
Learn PRG Pattern so that you can do this properly :)
http://en.wikipedia.org/wiki/Post/Redirect/Get
For example, you are trying to handle a user registration form, so what you do is you get a bunch of POSTed values, and save it into your database.
if(!empty($_POST)) {
// validate and save to db
// get last inserted user_id
}
After you do that, instead of returning the same page with the previously POSTed values, you redirect the new user, for example to his profile page (assuming you have no activation requirement in place)
if(!empty($_POST)) {
// validate and save to db
// get last inserted user_id, say in $user_id
header("Location: /users/$user_id");
}
That way, the browser redirects and you won't have problem with say, double registration, whenever the user hits refresh.
After saving to your database, reload your page:
if ($_POST) {
// Save $_POST to database and other stuffs
// Reload current page to discard $_POST
header('Location: my_page.php');
}
That's called PRG or Post/Reload/Get
You can use unset($var) to unset a variable. However, I think the issue is with the browsers; some of them try to be smart and will remember form data regardless when you refresh the page. If you hit "go" or "enter" on the URL bar it does a "true" refresh though.
As the title said, login page should be in flash(login.swf), and the redirect to a php page (account.php). In account.php, I will need to check session, for example:
isset($_SESSION['loggedin']){
echo "Welcome back, $user";
} else {
echo "You need to login and main site";
}
Where do I generate the sessions, and where do I store it, and how do I do the session check??
EDIT: About my current problems
Login in swf page
user type username and password and send to authenticate.php
if its valid user, i send variables back to flash: echo "login=true" and then start and create session e.g $_SESSION['username']
Back to flash, after some animation going, I click a button that link to profile.php page
In profile.php, i do a check if(isset($_SESSION['username']){ echo "welcome back user";
But the problem is, after i login in flash/swf page, i click the button to the profile.php page, I still need to login again, means, there is no $_SESSION['username'].
So, my questions: Where do I generate the sessions, and where do I store it, and how do I do the session check??
In the login.swf, on login button click, you need to do a http request to the server (say to validate.php page)with the credentials that user entered. In the validate.php you need to check for whether credentials are valid and need to create session if its valid and send back the response to the login.swf(in some xml format telling user is authenticated/valid or not).
On response handler of http request, get the result xml check whether user valid or not, if not valid show error message, if valid, call a javascript function(basically window.location.href='/account.php') which will redirect the entire page to account.php. Once the page request for account.php comes, you can use the session that you created and the user details from session.