Unset all $_POST variables so that I don't get alert box upon redirect

Question

After I submit a form I have 2 $_POST variables. In the landing page I want to turn them into $_SESSION variables and unset the $_POST ones so that the user won't get the alert of the browser to send their data again. This is my (not working) code:

 if(isset($_POST['clave']) && isset($_POST['email'])){
   $_SESSION['id_user']=$_POST['clave'];  
   $_SESSION['email']=$_POST['email'];  
 }
 if(isset($_SESSION['id_user']) && isset($_SESSION['email'])){
   unset($_POST['clave']); 
   unset($_POST['email']);
   //I do my stuff here
 }

If I echo the posts nothing will show but everytime I reload I get the browser warning again.

What is the *stuff* that you do? – Ed Heal Mar 22 '12 at 16:12 — Ed Heal, Mar 22 '12 at 16:12

score 8 · Accepted Answer · answered Mar 22 '12 at 16:12

8

You can't just delete the $_POST data from the server. The browser alerts it because it is stored by the browser. If it resubmits the data then it will send it back to the server and repopulate $_POST.

What you need to do is to use the POST-REDIRECT-GET pattern.

Process the POST data (e.g. by dumping it into the session), then send the browser a redirect and not an HTML document. The browser then makes a GET request to the server and you give them the page then.

answered Mar 22 '12 at 16:12

Quentin

914,110
126
1,211
1,335

Thank you. All the other answers were right but this one gives me a solution I can use to solve my problem. Cheers! – Elaine Marley Mar 22 '12 at 16:26

score 4 · Answer 2 · answered Mar 22 '12 at 16:13

It's not possible. When the user hits reload, the PREVIOUS action is redone, which was a post. Even though you've unset the POST values when the form was first submitted, the reload action will be an entirely NEW request. The browser will ALWAYS ask the user if they'd like to resubmit the data.

To prevent this, you have to redirect the user to another page AFTER the post is formed.

e.g.

user GETs the form.
user POSTs the form
server REDIRECTs user to a new page
user GETs the new page
user hits reload
user GETs the new page again - no POST is performed.

score 2 · Answer 3 · answered Mar 22 '12 at 16:13

This won't work because the browser is not warning you about the server-side, it's asking for confirmation that it should perform an unsafe action.

In most cases, you should be using the POST/Redirect/GET pattern, which does not suffer from this problem.

score 1 · Answer 4 · answered Jan 08 '13 at 13:15

its an old post, but i also faced the same problem, so here the easy solution,

create a login.php ==> which post two variables via html form
create a getHome.php ==> which will recieve two variables by $_POST['myvar']; function and put these two posted variables in a session, also echo wrong user n pass here if you like.
create a home.php ==> here you will put the if condition for checking session i.e. if(isset($_SESSION['myvar'])){ display home}else{ header('location: login.php'); *header function will redirect you to login.php iif you acess home.php file directly without logged in.

its done!!

Unset all $_POST variables so that I don't get alert box upon redirect

4 Answers4