Diese Seite bei php.net
The PHP manual text and comments are covered by the Creative Commons Attribution 3.0 License © the PHP Documentation Group - Impressum - mail("TO:Reinhard Neidl",...)
It took me a while to find out how to use PHP sessions to prevent HTML form re-submits. A user can re-submit a form via the backspace key/back arrow and/or the F5/refresh key. I needed to control if/when a HTML form could be resubmitted. Here's what I came up with:
<?php
strlen(session_id()) or session_start();
$_SESSION['err'] = ''; $exit = false;
do {
// check if form was previously submitted, e.g. user pressed "back" after submit
if(isset($_POST['submit']) and isset($_POST['SID']) and ($_POST['SID'] != session_id())) break;
// check if form previously verified, e.g. user pressed back after form receipt
if(isset($_SESSION['ok'])) { session_regenerate_id(true); session_destroy(); break; }
// break out of do-while if form has not been submitted yet
if(empty($_POST['submit'])) break;
// process form data if user hit form "submit" button
if(isset($_POST['submit'])) {
// clear vars after submit. previous form will be blank after browser back button
if(verify_form()) { session_regenerate_id(true); session_destroy(); $exit=true; display_receipt(); break; }
// keep vars after submit. allows browser back button to bring up previous form data
// if(verify_form()) { $_SESSION['err']=''; session_destroy(); $exit=true; display_receipt(); break; }
else { $_SESSION['err']="<p>Wrong answer $_SESSION[name]</p>"; }
}
} while(false);
$exit and exit;
// Move cleaned/valid POST data to SESSION. Only cleaned SESSION vars will be shown in html form
function verify_form() {
$_SESSION['name'] = htmlspecialchars(strtoupper($_POST['name'])); // clean POST data
if($_POST['great'] === 'yes') { $_SESSION['ok'] = 'ok'; return true; } // set if all data on the html form is valid
return false;
}
// display your "form was successfuly submitted" message
function display_receipt() { echo "I agree $_SESSION[name]<br>"; return; }
?>
<html><head></head><body>
<?php echo $_SESSION['err']; ?>
<form name="form1" action="http://<?php echo $_SERVER['HTTP_HOST'], $_SERVER['PHP_SELF']; ?>" method="post">
Name: <input type="text" name="name" value="<?php isset($_SESSION["name"]) and print $_SESSION["name"]; ?>">
Is PHP great? <input type="text" name="great" value="<?php isset($_SESSION["great"]) and print $_SESSION["great"]; ?>">
<input type="hidden" name="SID" value="<?php echo session_id(); ?>">
<input type="submit" name="submit" value="Submit">
</form></body></html>
I have wrote this following piece of code that shows how to work with global sessions (global to all clients) and private sessions (private per browser instance i.e. session cookie).
This code is usefull to store some read-only complex configuration and store it once (per server) and save the performance penatly for doing the same thing over each new private session...
Enjoy:
<?php
// Get the private context
session_name('Private');
session_start();
$private_id = session_id();
$b = $_SESSION['pr_key'];
session_write_close();
// Get the global context
session_name('Global');
session_id('TEST');
session_start();
$a = $_SESSION['key'];
session_write_close();
// Work & modify the global & private context (be ware of changing the global context!)
?>
<html>
<body>
<h1>Test 2: Global Count is: <?=++$a?></h1>
<h1>Test 2: Your Count is: <?=++$b?></h1>
<h1>Private ID is <?=$private_id?></h1>
<h1>Gloabl ID is <?=session_id()?></h1>
<pre>
<?php print_r($_SESSION); ?>
</pre>
</body>
</html>
<?php
// Store it back
session_name('Private');
session_id($private_id);
session_start();
$_SESSION['pr_key'] = $b;
session_write_close();
session_name('Global');
session_id('TEST');
session_start();
$_SESSION['key']=$a;
session_write_close();
?>
[EDIT BY danbrown AT php DOT net: Contains a bugfix provided by (lveillette AT silexmultimedia DOT com) on 19-NOV-09.]
Diese Seite bei php.net