Emptying $_POST variables or preventing page reloads

[salewit]

I've got a simple shopping cart system that doesn't use session variables. Instead data is POSTed from another page. On my final page after payment is retrieved, a receipt is displayed, database stuff is done, logfile stuff is done, and e-mails are sent. I want to either be able to clear $_POST data (so a page reload will not duplicate all these transactions) or prevent the page from being reloaded. Any tips on how to do this?

Thanks
Sam

 

[jpadie]

you can prevent a page reload causing this by a further page redirect. but this won't prevent a user from pressing the back button (or equivalent) and causing the same damage.

i have not found a sensible way to prevent this other than using some form of unique value in the (finally) posted data. that you compare against something before writing to the database. i use the session vars as the comparator but you could explicitly write the uid to a file or a database field if you are wholly against sessions.

 

[salewit]

Hmmm I never even thought of comparing a unique value in the database. That sounds simple enough. I guess what I was hoping for was some PHP command to clear out the POST data or something along the lines of $_POST[name] = "";

But the database check sounds good. Thanks so much!

 

[jpadie]

you can always reset the POST array or any element of it. but this is server side. when a page is reloaded the browser resends the data in the form so the receiving page has a whole new POST array and a new instantiation of the script.

 

[Kozusnik]

If you have a user_id or name with a datetime stamp, you could create a unique index based upon those values. If it tries to repost, it will fail.

Also, if you add...

<script language="javascript">
history.forward();
</script>

to the page, I believe it will disable the use of the back button.

Mark