Validate Form Re-Submitting On Refresh

[BorysSokolov]

Hello.

 

I'm having a difficulty with my code and I'd appreciate some assistance.

 

The below is a poll which is supposed to take user input in the form of radio-boxes and display the amount of users who have selected the given option. On the first run, it works fine, but whenever the page is refreshed, the form resubmits and the vote is entered again. I know this can be easily solved by posting the form information to another page and then redirecting back - and that's how I usually handled the problem in the past - but I'm wandering if there's a better way. Anybody got any ideas? Thanks in advance.

 

<!--start of poll-->
		<div id = "fullPoll"><!--POLL FORM-->
			<?php
			printRibbon('pollTag', 'Poll:' , 55, -30, 0, 20);
				include 'sitePoll.php';
				
					if(isset($_POST['option'])){//RADIOBOX
						if(!empty($_POST['option'])){
							$chosenOption = $_POST['option'];
						
							$queryVotes = mysql_query("SELECT ".$chosenOption." FROM sitepoll");
							$currentVotes = mysql_result($queryVotes, 0);
							$updateVotes = $currentVotes + 1;
						
							mysql_query("UPDATE sitepoll SET ".$chosenOption." = '".$updateVotes."'");
							header('Location: /No Common Theme/activeSourceTabLink.php');
						}else{
							?>
						<div class = "errorsDiv">
							Choose an option, Scrub.
						</div>
						<?php
							
						}
					}
					
					
			?>
		</div>
		<!--end of poll-->

 

 

[teynon]

You can set a session variable that says that the user has already answered the poll. Or you could use form tokens. (Send a form token with the form.) I think you should use both, as form tokens help with security and cross-site scripting as well. You might as well learn it now.

[Christian F.]

Best way is to send a Location HTTP header after saving the results to the database. That way if the user refreshes the page he'll send a GET request, instead of the previous POST request.

This can be done with the header function in PHP.

Edited February 27, 2013 by Christian F.

[BorysSokolov]

Best way is to send a Location HTTP header after saving the results to the database. That way if the user refreshes the page he'll send a GET request, instead of the previous POST request.

This can be done with the header function in PHP.

 

I've done something similar to what you suggested, and it worked out great

Thanks.