Question

Right now I have a form actioning to itself. There is some code the checks if the user is meant to be there. Is there a way to stop the script from running certain sections of code if it was actioned to itself after pressing submit.

I was thinking about using a SESSION variable to check against but I’ve gotten all muddle in my head :p

Any ideas?

Answer 1

Sure. If you’re self-submitting form actions, just check if $_POST is empty (assuming you’re POST’ing to your form)

if (!empty($_POST))
{
...
}

When I do PHP I use an input-element in my form template, like this:

<input type="submit" name="submit" id="submit" value="Login" /></td>

… and in the PHP page, I check if the POST was self-submitted like so:

// if page is not submitted to itself echo the form
if (!isset($_POST['submit']))
{
...
}

This is not secure though. If you want to reap the full benefits of self-submitting, you should try to counter Cross-site request forgery (XSRF) by challenging the client with a random token, and asking the client to repeat it.

Like embedded a hidden input in your form something like this:

<input type="hidden" name="nonce" value="<? echo $NONCE_VALUE; ?>" />