Question

So, I’m working on a commenting script. It works fine when you post a comment, but I found that when you refresh the page, even though the text field is empty, it still posts the same comment. I understand that this is because I’ve already sent the variable to $_POST, and it’s simply inserting that value in to the database, but how do I avoid this issue? Thanks in advance, and here is my code: (Assume that $username and $image are already set)

if (isset($_POST['text']) && !empty($_POST['text']))
        {
            $text = $_POST['text'];
            $timeStamp = time();

            mysql_query("INSERT INTO comments VALUES ('$image','$username','$text','$timeStamp')");
        }

And the HTML:

        <form method = "post" action = "/view.php?image=$image" />

            <input type = "text" name = "text" maxlength = "100" />
            <input type = "submit" value = "Add Comment" />

        </form>

Answer 1

The easiest way to avoid that, is redirecting after a successful database operation:

...
mysql_query("INSERT INTO comments VALUES ('$image','$username','$text','$timeStamp')");
// error handling
header('Location: /some/where');

Apart from that, you really need to switch to PDO / prepared statements to avoid sql injection problems.