Tweet
I have some code that I got that is supposed to prevent a form from being double-submitted and billing a customer twice.
Looking at the code, I'm not certain I understand how it works?!
Here it is...
Questions:
1.) How is it that a Form can be re-submitted and create a double-posting in the first place?
2.) If you submit a form like this, and then the form is re-displayed with a Pass/Fail message, and then you hit the "Back" button on your browser and then the "Forward" button, what values appear in the $_POST on this second time displaying the form?
3.) I've read this code several times, and even though it works, I'm not seeing where the $form_value gets changed so that it does not match $_SESSION['form_value']?!
It seems like you never get back to this code...
...even if you hit the "Back" and then "Forward" browser buttons?!
Thanks,
Debbie
Looking at the code, I'm not certain I understand how it works?!
Here it is...
PHP Code:
<?php session_start(); ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
</head>
<body>
<div id="wrapper" class="clearfix">
<div id="inner">
<!-- Include BODY HEADER -->
<?php require_once(ROOT . 'components/body_header.inc.php'); ?>
<!-- PAYMENT FORM -->
<div id="paymentForm">
<?php
// Initialize variables.
$form_value = '';
// Check if Form value was set.
if (isset($_POST['form_value'])){
$form_value = $_POST['form_value'];
}
// Check if Form value was set in $_SESSION.
if (!isset($_SESSION['form_value'])){
$_SESSION['form_value'] = '';
}
// *********************************************************************
// HANDLE FORM.
// *********************************************************************
if (isset($_POST['submitted'])){
// Form was Submitted.
// Check for Double-Submittal.
if ($form_value == $_SESSION['form_value']){
// Initial Payment was Submitted.
// Check for Errors.
if (empty($errors)){
// PROCESS PAYMENT.
// Force new Unique ID to be assigned on Form Re-submit!!!
// unset($_SESSION['form_value']);
switch($response_array[0]){
case "1":
// Approved.
$responseMsg1 = "<p>Congratulations! Your transaction was successful.</p>
<p>Your Order Number is: '" . $invoiceNumber . "'</p>";
// Do not return to Payment Form!!!
exit();
}// End of CHECK FOR ERRORS.
}else{
// Form Double-Submitted!!
$responseMsg1 = "<p>Sorry! You have already submitted a payment.</p>";
$responseMsg2 = "<p>For your protection, this Payment Form has been disabled.</p>";
// Do not return to Payment Form!!!
exit();
}// End of CHECK FOR DOUBLE-SUBMITTAL.
}else{
// Drop through to Payment Form.
}// End of HANDLE FORM.
?>
<!-- NEW -->
<?php
// Create a Unique ID to be assigned to Form.
$_SESSION['form_value'] = md5(uniqid(rand(), true));
?>
<!-- @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ -->
<!-- HTML PAYMENT FORM -->
<form id="payment" action="" method="post">
<!-- NEW -->
<!-- Hidden field used to store Form's Unique ID. -->
<input type="hidden" name="form_value" id="form_value"
value="<?php echo $_SESSION['form_value']; ?>" />
<!-- Submit Form -->
<fieldset id="submit">
<!-- Place Order button -->
<input name="submit" type="image" src="../buttons/PlaceOrder_black.png" value="Place Order" />
<input name="submitted" type="hidden" value="true" />
</fieldset>
</form>
</div><!-- End of PAYMENT FORM -->
</div><!-- End of #INNER -->
</div><!-- End of #WRAPPER -->
</body>
</html>
Questions:
1.) How is it that a Form can be re-submitted and create a double-posting in the first place?
2.) If you submit a form like this, and then the form is re-displayed with a Pass/Fail message, and then you hit the "Back" button on your browser and then the "Forward" button, what values appear in the $_POST on this second time displaying the form?
3.) I've read this code several times, and even though it works, I'm not seeing where the $form_value gets changed so that it does not match $_SESSION['form_value']?!
It seems like you never get back to this code...
PHP Code:
<!-- NEW -->
<?php
// Create a Unique ID to be assigned to Form.
$_SESSION['form_value'] = md5(uniqid(rand(), true));
?>
Thanks,
Debbie
I know I started using this code after I found out that people could resubmit the Credit card Checkout Form a million times if I didn't prevent that!!)
I have a page for payments that is just over 400 lines long and does everything needed.
Comment