Prevent Empty And Duplicate Form Submissions

[wright67uk]

How do i get the following code to only process when the form is filled?

 

at the moment i get an empty/duplicate record set added to my database upon a page refresh.

 

What code should I add/change, and where?

 

 

$sql = "INSERT INTO snag_score_cards 
      (user_id, location, par1, par2, par3, par4, par5, par6, par7, par8, par9)
VALUES ('$user_id', '$_POST[location]', '$_POST[par1]', '$_POST[par2]', '$_POST[par3]', '$_POST[par4]', '$_POST[par5]', '$_POST[par6]', '$_POST[par7]', '$_POST[par8]', '$_POST[par9]')";


if (!mysql_query($sql))
 {
 die('Error: ' . mysql_error());
 }
if(isset($_POST['submit'])) 
{ 
   $location = $_POST['location'];
   echo "A scorecard for $location, has now been added";
   echo "<br>You can use the form again to enter a new card."; 
}


?>


<p>Enter your location</p>
<form name="form" method="post" action="<?php echo $_SERVER['PHP_SELF']; ?>" method="post"> 


<input autocomplete="off" name="location" id="location" size="18" value=""/><br /><br />



<input type="text" autocomplete="off" name="Scores"    id="Score"     value="Score"      readonly style="border:0px" />
<input type="text" autocomplete="off" name="Par1"       id="Par"       value=" Par"       readonly style="border:0px" />
<input                                name="Par Score" id="ParScore"  value=" Par Score" readonly style="border:0px" /><br>


<input type="text" autocomplete="off"  name="sum1" id="hole1A" readonly value="" /> 
<input type="text" autocomplete="off" name="par1" value=""  id="hole1B" /> 
<input type="text" name="sum" value="" id="hole1result" readonly style=""> <br>


<input type="text" autocomplete="off" name="sum1" id="hole2A" readonly value="" /> 
<input type="text" autocomplete="off" name="par2" value="" id="hole2B" /> 
<input type="text" name="sum2T" value="" id="hole2result" readonly style=""> <br>


<input type="text" autocomplete="off" name="sum1" id="hole3A" readonly value="" /> 
<input type="text" autocomplete="off" name="par3" value="" id="hole3B"  /> 
<input type="text" name="sum3" value="" id="hole3result" readonly style=""> <br>


<input type="text" autocomplete="off" name="sum1" id="hole4A" readonly value=""  /> 
<input type="text" autocomplete="off" name="par4" value="" id="hole4B"  /> 
<input type="text" name="sum4" value="" id="hole4result" readonly style=""> <br>


<input type="text" autocomplete="off" name="sum1" id="hole5A" readonly value="" /> 
<input type="text" autocomplete="off" name="par5" value="" id="hole5B"  /> 
<input type="text" name="sum5" value="" id="hole5result" readonly style=""> <br>



<input type="text" autocomplete="off" name="sum1" id="hole6A" readonly value=""  /> 
<input type="text" autocomplete="off" name="par6" value="" id="hole6B"  /> 
<input type="text" name="sum6" value="" id="hole6result" readonly style=""> <br>


<input type="text" autocomplete="off" name="sum1" id="hole7A" readonly value=""  /> 
<input type="text" autocomplete="off" name="par7" value="" id="hole7B"  /> 
<input type="text" name="sum7" value="" id="hole7result" readonly style=""> <br>


<input type="text" autocomplete="off" name="sum1" id="hole8A" readonly value=""  /> 
<input type="text" autocomplete="off" name="par8" value="" id="hole8B"  /> 
<input type="text" name="sum8" value="" id="hole8result" readonly style=""> <br>


<input type="text" autocomplete="off" name="sum1" id="hole9A" readonly value=""  /> 
<input type="text" autocomplete="off" name="par9" value="" id="hole9B"  /> 
<input type="text" name="sum9" value="" id="hole9result" readonly style=""> <br>


<input type="text" name=""  id=""  value=""  readonly style="border:0px" />
<input type="text" name=""  id=""  value=""  readonly style="border:0px" />



<input type="submit" name="submit" value="Create"/>


</form>
</body> </html>

[cpd]

Research "form validation using php".

[cyberRobot]

You may also want to look into

• SQL injections (http://www.tizag.com...l-injection.php)
  
• XSS attacks on PHP_SELF (http://seancoates.com/blogs/xss-woes)
  

[wright67uk]

Thankyou for the replies. In the first instance I have tried...

 

 

if (!mysql_query($sql))

{

die('Error: ' . mysql_error());

}

if (!$_POST['location'] )

{

die('You did not complete all of the required fields');

}

if(isset($_POST['submit']))

{

$location = $_POST['location'];

echo "A scorecard for $location, has now been added";

echo "<br>You can use the form again to enter a new card.";

 

}

[Code/]

 

But all that appears is the location die message

[wright67uk]

... Not even the form..

 

Where should I put the location if statement?

 

[cpd]

Where you carry out validation is dependent on your system. If your just writing procedural scripts you can place it at the top of the script but if your using an MVC approach you can place it in your Model.

[wright67uk]

It doesn't work at the top of my script either

[cyberRobot]

It would help to see the new code. Also, it helps to describe what you mean by it doesn't work. Are you getting errors? If so, what are they?

[wright67uk]

To be honest, I've tried putting this line in several different places.

 

It displays the die message before the user sees the form.

 

I've tried searching for tutorials and forums, that can show me how to use an if statement with a form that posts to self, Like the one in my example. It would help if someone would be kind enough to tell me where I should be putting my line and more importantly why. Or... Maybe someone knows of a good tutorial?

if (!$_POST['location'] ) { die('You did not complete all of the required fields'); }

[cyberRobot]

You'll need to have an if statement that detects the form submission. I usually do something like the following:

 

<?php
if(isset($_POST['processForm'])) {
    //process form here
    print 'here';
}
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Untitled Document</title>
</head>

<body>
<form method="post" action="pagename.php">
<input type="hidden" name="processForm" value="1" />
<input type="submit" value="submit" />
</form>
</body>
</html>

[cpd]

Killing the script because of invalid data isn't a good idea either. You should be able to handle this and send and give an error message allowing the user to adjust the details.