Home
>
Web Development
>
Preventing Repeat Form Submission Using PHP Sessions

Preventing Repeat Form Submission Using PHP Sessions

We've all seen those messages on some websites warning not to click a button more than once or negative consequences, like paying a bill twice, may result. Sometimes we can cause these problems by hitting the back or refresh buttons. In this article I will explain a methodology whereby a site can ensure each form is submitted only once, thereby demonstrating that such warnings are unnecessary and, depending on the nature of the problems caused, worth repairing immediately. Let's begin by taking a look at the process we are studying: Form Submission. As pedantic as it may seem, it will be worthwhile to detail each of the steps in this process:

Visitor requests a page from the server which has a form on it.

Server retrieves form and sends to user.

User enters data on form and submits to server.

Server processes form data and returns resultant page.

The scenario we now need to analyze is when the user re-triggers a previous form submission process. What we need to find or create is something which changes during the form submission process which does not depend on the specific form being submitted and which we can tell changed. That was a loaded sentence which fully details our solution, so let's break it down. Find or create something which

changes during the form submission process,

does not depend on the specific form being submitted, and

we can tell changed.

Since the item which changes does not depend on the form being submitted (e.g. it doesn't matter if it's a newsletter registration form, customer signup form, payment form, etc.), the item is not something which already exists and therefore must be created, so let's create a form variable called submissionId and assume it has the 3 properties mentioned above. So far, so good -- or so it appears! The third "property" is that "we can tell [it] changed", but "changed" is not a property of a variable, so we need to look at this more closely. In order to tell something changed, we must have a reference point, an answer to the question "changed from what?" This is where a session variable will come into play. If we define a session variable, say $_SESSION['nextValidSubmission'] and treat it as a reference point, we will have all of the tools necessary to protect our visitors. The idea will be to keep the session variable updated with the last submissionId sent out and change the submissionId each time it is sent out to the user. Then, if they try to resubmit the data, they will be submitting an old submissionId which doesn't match nextValidSubmission and we will know not to re-process this data. Let's look at this in terms of the processes:

Visitor requests a page from the server which has a form on it.

Server retrieves form, generates a new submissionId which is embedded into the form, updates nextValidSubmission, and sends to user.

User enters data on form and submits to server.

Server processes form data, changes nextValidSubmission, and returns resultant page.

Now, if the visitor somehow resends the data, they will be sending the old submissionId which will not match the new nextValidSubmission. So, you can now say goodbye to relying on javascript to remove/disable buttons, silly warning messages, and upset customers by preventing form re-submission.

Webmaster of script reference - The *NEW* PHP Reference & Tutorial Site For Non-Programmers
script reference

local house cleaners Arlington Heights ...

In The News:

Jevon Martinez livestreamed himself removing 10 Flock Safety cameras in Bernalillo County, but authorities say eight belonged to neighborhood associations.

A dark web service called Nexus claimed to hold over 153 million driver's license records, and the FBI confirms it is now looking into the incident.

Asking Siri to call American Express connected an 82-year-old woman to a bogus number that nearly drained $100,000 from her Bank of America account.

The Fox News AI Newsletter covers the latest artificial intelligence technology advancements, including the challenges and opportunities AI presents now and for the future.

iPhone Duo opens to a 7.6-inch foldable display starting at $1,999, but Siri Recap's ambient listening on Apple Watch may spark privacy concerns.

Homeowners association meeting minutes and membership lists can expose names, addresses and emails that scammers use to craft convincing phishing scams.

Lima, Ohio, has installed 3,120 floating solar panels on its Twin Lakes Reservoir, projecting nearly $10 million in electricity cost savings.

Amazon's Alexa for Shopping now lets customers verify suspicious emails, texts and phone calls against the company's own communication records.

Lindsey Brooke Isaacs spent 13 days in jail after a Flock camera flagged her Dodge Durango near a fatal Florida crash that killed three people.

AI-powered smart grocery carts are linked to 32% higher spending, according to new research, as Instacart Caper Carts expand across U.S. stores.

A VPN encrypts your connection on hotel, airport and café Wi-Fi abroad, but streaming catalogs and live sports access still depend on provider rules.

Gmail's Verified Sender Program launches September 8, 2026, giving U.S. political committees a more reliable path to your personal email inbox.

Elroy Air's Chaparral can carry over 500 pounds and fly 450 miles without a runway, and the FAA just tested it under a new federal program.

Bedrock Robotics says its autonomous excavators are doing paid earthwork on active job sites in Texas and Nevada with no operator in the cab.

A dedicated banking computer isolates your financial accounts from malware and phishing, but passwords, SIM swapping and outdated software remain risks.

The OlloNi SS1 AI robot pet uses a 4K camera and facial recognition to learn your family, but its removable Red Heart memory module raises questions.

Nine identity theft warning signs range from unfamiliar credit inquiries to SIM swap attacks that can quietly drain your bank account funds.

Robot.com's R-dog uses articulated legs and wheels to climb stairs and deliver packages, while its built-in screens display paid ads along the route.

MyChart phishing emails mimic real patient portal alerts with fake lab results and malware tricks that target Windows users across the country.

The Fox News AI Newsletter covers the latest artificial intelligence technology advancements, including the challenges and opportunities AI presents now and for the future.

Google's Motion Assist places animated dots on Pixel screens to combat motion sickness in vehicles, but the Android 17 rollout remains limited.

Moving to a 55+ community can quickly expose your data to scammers and data brokers before you even unpack, putting your whole family at risk.

Amazon Prime Air drone delivery plans to reach nearly 500 U.S. cities by the end of 2026, but your yard and ZIP code may determine eligibility.

The FBI reports nearly $21 billion in cybercrime losses for 2025, up 26%, as AI scams make fake voices and identities more convincing than ever.

Uber teen accounts now feature live video streaming from the driver's camera, but encrypted recordings stay on Uber's servers for up to 14 days.

Preventing Repeat Form Submission Using PHP Sessions

Web Development