Text posted by 'echo' function still persists when refresh button is pressed.-- PHP - php

Question

<?php
session_start();
$root = 'root';
mysql_connect('localhost',$root,'') or die(mysql_error());
mysql_select_db("test_create_database") or die(mysql_error());
$result = mysql_query("SELECT * FROM members");
$row = mysql_fetch_assoc($result);
$username="";
$password="";
$id="";
if(isset($_POST["submit"]))
{
if(isset($_POST["submit"]) && !empty($_POST["username"]) && !empty($_POST["password"]) && !empty($_POST["id"]))
{
if(isset($_POST["username"]) && isset($_POST["password"]) && isset($_POST["id"]))
{ $username = $row["username"];
$password = $row["password"];
$id = $row["id"];
if($username == "John" && $password =="1234" && $id =="1")
{
echo "you're in";
}
else
{
echo "you're out!";
}
}
}
elseif (isset($_POST["submit"]) && (empty($_POST["username"]) || empty($_POST["password"]) || empty($_POST["id"])))
{
echo "enter all fields please!!!!";
}
}
session_destroy();
?>
if at first all the fields are filled in correctly and the submit button is pressed, the text "you're in" is printed onto the webpage and the text in the fields disappears. but if I refresh the page again, the printed text "you're in" still remains even though I have invoked the session_destroy() function. I don't understand why the session has not been destroyed. Any help would be appreciated.

Answer 1

The bits about session_start() and session_destroy() do not influence the POST-variables. As BugFinder pointed out, refreshing the page often re-submits whatever data you've just submitted. That's why the 'you're in'-message is presented again.
A way of preventing this behaviour is by redirecting after the submitted data has been processed. You could then set a session variable to keep track of the message you still need to display (or, if the user is logged in or not).
Your code would look something like this:
<?php
session_start();
$root = 'root';
mysql_connect('localhost',$root,'') or die(mysql_error());
mysql_select_db("test_create_database") or die(mysql_error());
$result = mysql_query("SELECT * FROM members");
$row = mysql_fetch_assoc($result);
$username="";
$password="";
$id="";
if(isset($_POST["submit"]))
{
if(isset($_POST["submit"]) && !empty($_POST["username"]) && !empty($_POST["password"]) && !empty($_POST["id"]))
{
if(isset($_POST["username"]) && isset($_POST["password"]) && isset($_POST["id"]))
{ $username = $row["username"];
$password = $row["password"];
$id = $row["id"];
if($username == "John" && $password =="1234" && $id =="1")
{
//do stuff
$_SESSION['message'] = "you're in";
}
else
{
$_SESSION['message'] = "you're out!";
}
}
}
elseif (isset($_POST["submit"]) && (empty($_POST["username"]) || empty($_POST["password"]) || empty($_POST["id"])))
{
$_SESSION['message'] = "enter all fields please!!!!";
}
$selfLink = $_SERVER['PHP_SELF'];
if (isset($_SERVER['QUERY_STRING'])) {
$selfLink .= "?" . $_SERVER['QUERY_STRING'];
}
header('location: '.$selfLink);
exit;
}
if (isset($_SESSION['message'])) {
echo $_SESSION['message'];
unset($_SESSION['message']);
}
?>
Note that the redirecting to the page itself seems a bit forced (using $_SERVER['QUERY_STRING'] to fetch the current page's location). It works more intuitively if you know the file name or if you're redirecting to a different page after handling form input.

Answer 2

isset($_POST["submit"]) remove this check in elseif.
After submit form and explicit refresh of page $_POST["submit"] is set but if u go manually to that page $_POST["submit"] will not be set.