How to prevent multiple inserts when submitting a form in PHP?

There are several solutions to this problem:

1. Use Javascript to disable the form’s submit button when it is posted. Downside to this is that this is ABSOLUTELY not a foolproof way. It’s very easy to submit forms without actually clicking the button, and this would also not work for users with JavaScript disabled. I would definitely not recommend this method.

   Example:

   <script language="javascript">
   <!--
       function disableSubmitButton() {
           // you may fill in the blanks :)
       }
   -->
   </script>
   <form action="foo.php" method="post">
       <input type="text" name="bar" />
       <input type="submit" value="Save" onclick="disableSubmitButton();">
   </form>
   

2. Use PHP sessions to set a session variable (for example $_SESSION[‘posttimer’]) to the current timestamp on post. Before actually processing the form in PHP, check if the $_SESSION[‘posttimer’] variable exists and check for a certain timestamp difference (IE: 2 seconds). This way, you can easily filter out double submits.

   Example:

   // form.html
   <form action="foo.php" method="post">
       <input type="text" name="bar" />
       <input type="submit" value="Save">
   </form>
   
   // foo.php
   if (isset($_POST) && !empty($_POST)) 
   {
       if (isset($_SESSION['posttimer']))
       {
           if ( (time() - $_SESSION['posttimer']) <= 2)
           {
               // less then 2 seconds since last post
           }
           else
           {
               // more than 2 seconds since last post
           }
       }
       $_SESSION['posttimer'] = time();
   }
   

3. Include a unique token on each POST. In this case, you would also set a session variable to the token you want to include and then render the token in the form. Once the form is submitted, you re-generate the token. When the submitted token does not match the token in your session, the form has been re-submitted and should be declared invalid.

   Example:

   // form.php
   <?php
       // obviously this can be anything you want, as long as it is unique
       $_SESSION['token'] = md5(session_id() . time());
   ?>
   <form action="foo.php" method="post">
       <input type="hidden" name="token" value="<?php echo $_SESSION['token'] ?>" />
       <input type="text" name="bar" />
       <input type="submit" value="Save" />
   </form>
   
   // foo.php
   if (isset($_SESSION['token']))
   {
       if (isset($_POST['token']))
       {
           if ($_POST['token'] != $_SESSION['token'])
           {
               // double submit
           }
       }
   }