PHP Prevent Re submission for multiple forms on same page

Question

Hi have checked answer from this page: But it uses action="" is it vulnerable to XSS attacks? If yes then without such solution what are my options?

I tried using header redirect. But as I have 2 forms,(in some pages 4-5 forms) header re direction is not working for me with errors.

Here is my code: (Simplified)

1st form: works ok with a redirect.

<form name="ip_block" method="post" class="form-horizontal">
            <div class="form-group">
           <label class="control-label col-sm-2" for="ip"> Enter IP:</label>
            <div class="col-sm-8">
                <input type="text" name="ip" class="form-control" id="ip" />
          </div></div>
         <div class="form-group"> 
            <div class="col-sm-offset-2 col-sm-8">
            <button type="submit" class="btn btn-default" 
            name="ip_block_add">Submit</button>
               </div></div>
             </form> 
        <?php
          if(isset($_POST['ip'])){
              if($IP = filter_input(INPUT_POST, 'ip', 
                FILTER_SANITIZE_STRING)){
              $add_ip = $mysqli->prepare("INSERT INTO block_ip(b_ip) 
                VALUES(?)");
              $add_ip->bind_param("s",$IP);
              $add_ip->execute();
              $add_ip->store_result();
              $add_ip->close();
             header("refresh:5;url=./admin-security.php");// avoiding form 
                 resubmission
             echo 'Added successfully';
              }
              else {
                    echo 'failed to insert';
              }
          }
        ?>

Form 2:

 <form name="clear_data" method="post">
            <input type="hidden" name="data_clear" value="1"/>
            <button type="submit" class="btn btn-warning">Clean Data</button>
        </form>
                 <?php
              if(isset($_POST['data_clear'])){
              if($mysqli->query("CALL clear_old_data")){ 
              header("refresh:5;url=./admin-security.php");// avoiding form resubmission
              echo 'operation successfull'; 
              }   
       else
       {
         echo 'database failure';
          }
        }
      //----
    ?>

For Second form I get error like this

Warning: Cannot modify header information - headers already sent by

For 2nd form I am using header before echo still it doesn't work. reference, I tried with javascript too but that failed.

 echo "<script>setTimeout('window.location.href='./admin-
 security.php';',4000);</script>";

Updated with Dainis Abols idea: but form re submit option is still showing on page refresh

            <form name="clear_data" method="post">
            <input type="hidden" name="data_clear" value="1"/>
            <?php
               $var=111;
               $_SESSION['var']=$var;
               ?>
            <input type="hidden" value="<?php echo $var; ?>" name="varcheck" 
              />
            <button type="submit" class="btn btn-warning">Clean 
                  Data</button>
                   </form>
                 <?php
              if(isset($_POST['data_clear']) && 
            ($_POST['varcheck']==$_SESSION['var'])){
             // Some code
             }

You can add a token field to your forms that get written in the session. After the submit, just read the submitted token and the one that is stored in your session. That way you can check, if the form has been correctly submitted from your own site. — Peon
– Peon, Commented Sep 13, 2017 at 6:38
this operation is done on the admin page, so admin has login session too, hope it will not create any interference. — mimi
– mimi, Commented Sep 13, 2017 at 6:42
I believe you can write a simple value to variable assignment and session value assignment on your own. — Peon
– Peon, Commented Sep 13, 2017 at 6:43

Ylich · Accepted Answer · 2017-09-14 06:37:16Z

1

I'd rather use ajax to send data to the database, without form submiting, and on success I would use js to redirect to /admin-security.php. In this case it's not possible to send the data twice.

Here is the PHP Code:

     <?php
      if(isset($_POST['ip'])){
          if($IP = filter_input(INPUT_POST, 'ip', 
            FILTER_SANITIZE_STRING)){
          $add_ip = $mysqli->prepare("INSERT INTO block_ip(b_ip) 
            VALUES(?)");
          $add_ip->bind_param("s",$IP);
          $add_ip->execute();
          $add_ip->store_result();
          $add_ip->close();
         echo 1;
          }
          else {
                echo 0;
          }
       exit;
      }
    ?>

HTML:

<div class="form-horizontal">
        <div class="form-group">
       <label class="control-label col-sm-2" for="ip"> Enter IP:</label>
        <div class="col-sm-8">
            <input type="text" name="ip" class="form-control" id="ip" />
      </div></div>
     <div class="form-group"> 
        <div class="col-sm-offset-2 col-sm-8">
       <button type="button" onClick="send_form()" class="btn btn-default" 
        >Submit</button>
           </div></div>
         </div>

And AJAX written with JQuery

<script>
function send_form() {
  $.ajax({
     url: "./admin-security.php",
     type: "POST",
     data: {
       ip: $("#ip").val()
     },
     success: function(response) {
          if(response==1) {
              alert("Done");
              location.href = "./admin-security.php";
          }
          else alert("Fail!");
      }
  });
 }

edited Sep 14, 2017 at 6:37

answered Sep 13, 2017 at 6:44

Ylich

706 bronze badges

Sign up to request clarification or add additional context in comments.

14 Comments

mimi Over a year ago

plus in some cases, if I need to validate data does it works with your method?

mimi Over a year ago

Hello, thank you for your code, but it's not working, can you please check your ajax code. I think it's missing a 2nd bracket. Plus location url should be something like this isn't it? Based with my original code location.href = "./admin-security.php";

mimi Over a year ago

Also not sure about this part : url: "this_page.php", what will be this page. I have all codes on same page admin-security.php, so will it be something like this url: "./admin-security.php", ?

Ylich Over a year ago

@mimi You were right with the second bracket! The url has to be the correct path to your script. If you have the whole script in ./admin-security.php, then you have to put this. I think the code should work now.

mimi Over a year ago

thank you for your prompt reply, let me check & get back to you.

|

Collectives™ on Stack Overflow

PHP Prevent Re submission for multiple forms on same page

1 Answer 1

14 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

14 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related