Search code examples
phppost-redirect-get

php is it possible to post redirect get with form action = $_SERVER['PHP_SELF']

I'm using this code in my form

form action="<?php $_SERVER['PHP_SELF']?>" method="post"

Is there anyway I can POST-Redirect-GET when the form data is submitted by user? I'm trying to avoid duplicate form submissions from user hitting refresh.

like in this example .

I don't see how this could work if I'm using PHP_SELF in the form action. Any ideas?

Solution

    1. Using PHP_SELF like that is exploitable, it allows for XSS. Just leave action blank like action="" and the form will submit to the page it's currently on.

    2. If you want to prevent repeat submissions via refresh then issue a 302 redirect after receiving the form submission.

      header("Location: /somewhere_else.php", true, 302);