my eventual solution to this was a very complicated form setup whereby each form was only submittable once.
You add an extra field 'formhash' to your forms, in the php you set a session variable $_SESSION['formhashes'] which is an array of all valid hashes. So you might have something like this:
$_SESSION['formhash'] = array('formhash1'=>1,'formhash2'=>0);
formhash 2 having been used is invalidated; when the script is finished processing you can delete it entrily from the array. I generated the hashes by simply MD5ing the timestamp . a random number . their userid
If a form with an invalid formhash is submitted you reject the data. I had this builtin to my input handling class so it was seamless on the forms it was used on.
|
08-02-2007, 08:52 PM
Hybrid Mode
