I am working on a method to prevent users from resubmitting a PHP form and I thought of many methods, but this one seemed to be the most reliable in my tests. I did not want to create redirects for development purposes, and transferring data around.

I create a hidden input with the form holding the time() of which the page loads. Then when the form is submitted I check for the time_stamp + int < time().

This is what it looks like in practice:

$unix = $_POST['unix_timeStamp'];
if($unix + 1800 > time())
    echo "You too long friend <br>";
    echo 'start time: '. $unix . ' <br>';
    echo 'end time: '. time();

It works fine, after 1800 seconds (30 minutes) the form will simply indicate that the time has expired and they have to start again.

I am just wondering if this is a fool-proof system. Not security wise, but just to prevent double-submits or users taking too long.


I see how this stops the user from taking too long to fill out the form (which is not necessarily something you want to stop), but I don't understand how this prevents double submits at all. Typical reasons for double submits:

  1. The user clicks submit, the website response slowly, they click submit again
  2. After submitting, if no redirect happens (you said you don't want redirects), the person can hit back and be presented with "Must resubmit data". If they refresh on this screen a second submit will happen.

In both cases the second submit can happen just moments after the first, so I don't understand how a time-based limit can stop either kind of double submit.

In the past when I've wanted to prevent double submits without using redirects I've done so by keeping track of a unique key in the session everytime I displayed the form. When the form came back up, the unique key came with it (in a hidden input like yours), and I marked that unique key as "used". Anytime a submit came up I checked its key against the list of "used" unique keys. If the key in the form was marked as used, then I knew it was a double submit, and returned an error to the user letting them know.

As an aside, the need to send out a unique key with each form happens to also be a requirement for CSRF protection, so I actually just rolled both bits of functionality into one and killed two birds with one stone.

| improve this answer | |
  • \$\begingroup\$ Thank you, that makes sense. I will probably head down that way for the form. I appreciate the input, it is very helpful \$\endgroup\$ – Sam Sep 29 '17 at 13:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.