Home/ Questions/Q 9130187
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-17T07:54:53+00:00

I have a database, and one table (innoDB): table. Row in this table is:

  • 0

I have a database, and one table (innoDB): table.

Row in this table is: m1 and m2.

I have 2 submit buttons on one page.

Submit 1 does this:

Database::q('UPDATE table SET m1 = ?s, m2 = ?i WHERE id = ?i', $n, 0, $ID);

Submit 2 does this:

Database::q('UPDATE table SET m2 = ?s WHERE id = ?i', $n2, $ID);

The problem: if a user submits both forms at det same time. Lets say 100 000 ($n) on submit 1 and 50 ($n2) on submit 2.
The result will be after updates: 99 950 on m1 and 100 000 on m2.

How can i prevent this?
I tried using transactions but its still not working properly.

Is this syntax correct? I dont understand when to use whitch one: exec, query, execute?

try {
   Database::beginTransaction();
   Database::q('..');
   Database::commit();
} catch (Exception $e) {
   Database::rollBack();
   echo 'ERROR!';
}

This is the databass class i am using:
http://pastebin.com/PfsiYysX

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    As Martin suggests, some javascript will prevent accidental pressing of both buttons. However it doesn’t work in all cases and certainly provides no protection against deliberate submisson of both forms. However it will prevent most users from arriving at the point where you apply real, effective controls to the operation.

    A more secure solution would be to incorporate a single use CSRF token (copy of the same token in both forms) – check and expire the token on the first request. The problem with this is that users may perceive that there is a fault if they split the session (open new window). There are ways of mitigating this – but it depends on the specific details of how the application is implemented.

    A better solution would be to model the as a finite state machine, allowing both updates when the data is in the initial state but disallowing a subsequent update. I’d have provided an example but that’s not possible from the data you have provided. So instead consider this: a user has filled a shopping basket and goes to the checkout. At this point they have 2 choices – make the purchase or discard the basket. If they click on ‘make purchase’, if so, then you set the status to ‘buying’ where the basket status is ‘at checkout’ if this is successful then you proceed with the purchase processing. If they click on ‘discard’ then you change the basket status to ‘discarding’ where the status is ‘at checkout’, if successful, then you proceed with the clean up. If either operation is not successful, then you report an error. Note that each operation should auto-commit – and this does not use locks.

    • 0