How to avoid resending data on refresh in php

Question

I have a page "index.php" where i have a link called "add_users.php". In "add_users.php", I accept user information and come back to the same page "index.php" where information comes through post action and gets inserted into the database.

When I refresh the page or hit the back button, a resend box appears. I went through many solution where they asked me to create third page. I tried doing that as follows: after inserting values in database, I redirected the page as header('Location:http://thisisawebsite.com/thankyou.php, and in thankyou.php I again redirected the page to index.php. But this resulted in getting a warning as "Cannot modify header information - headers already sent by [....]"

What is a better solution?

Answer 1

Priyanka,

You are on the right track. What you are trying to implement is actually a well known pattern used in web-developing called the POST/Redirect/GET pattern. (Pattern is a bit of a buzz word now-a-days, so maybe paradigm is a better word for this).

A common implementation of this pattern/paradigm is to simply have only one point of entry.

By doing this, add_user.php could now look like this (it's still not the most elegant, but hopefully it will give you an idea of how to go about implementing it):

<?php

// is this a post request?
if( !empty( $_POST ) )
{
   /*
     process the form submission
     and on success (a boolean value which you would put in $success), do a redirect
   */
   if( $success )
   {
       header( 'HTTP/1.1 303 See Other' );
       header( 'Location: http://www.example.com/add_user.php?message=success' );
       exit();
   }
   /* 
      if not successful, simply fall through here
   */
}

// has the form submission succeeded? then only show the thank you message
if( isset( $_GET[ 'message' ] ) && $_GET[ 'message' ] == 'success' )
{
?>

<h2>Thank you</h2>
<p>
You details have been submitted succesfully.
</p>

<?php
}
// else show the form, either a clean one or with possible error messages
else
{
?>

<!-- here you would put the html of the form, either a clean one or with possible error messages -->

<?php
}
?>

So, how it basically works is this:

• If the request made to the script IS NOT a POST request (i.e. the form has not been submitted) and there is no ?message=success appended to the url then simply show a clean form.
• If the request made to the script IS a POST request, then process the form.
  • If form processing succeeded, redirect to the same script again, and append ?message=success
    • If the request to the script is a request with ?message=success appended to it only show a thank you message, don't show the form.
  • If form processing failed, then let it 'fall through' and show the form again, but this time with some descriptive error messages and with the form elements filled with what the user already had filled in.

Hopefully this, along with the example I gave you, makes enough sense.

Now, the reason you were getting the infamous Warning: headers already sent message is explained in this answer I gave to another question about why certain php calls are better to put at the top of a script (actually, it doesn't necessarily have to be on top, but it has to be called before ANY output (even (accidental) whitespace) is being output).