PHP How to Differentiate Between Form POST and Page Refresh

PHP Code to Distinguish Between a Form Post and a Page Refresh which Prevents Double Form Post Processing on the Server

To distinguish between an actual form submssion of $_POST values and a page reload or refresh prevent multiple form submission processing in php ...

1. create a $_SESSION variable such as $_SESSION["form_token"]
2. Insert the token into a hidden element on the pages form.
3. On the page where the form is posted and processed in php, check for the presence of this token and that this token matches or equals $_SESSION["form_token"].
• If it does then you know you have a form submission and not a page refresh so delete the $_SESSION["form_token"] via unset($_SESSION["form_token"]) so that way if the form is refreshed $_SESSION["form_token"] no longer exists so you know its merely a page reload.

On the Page where the Form is

In the php code ...

if (!isset($_SESSION["token"])) { $_SESSION["form_token"] = bin2hex(random_bytes(32)); }

In the html code for the form insert this hidden element ...

<input type="hidden" name="token" value="<?=$_SESSION['form_token'];?>">

On the Page where the Form $_POST Values are Processed

The function that checks if this is an actual $_POST or page refresh

function isFormPostNotPageRefresh(string $postedToken) { if (isset($_SESSION["form_token"]) && hash_equals($_SESSION["form_token"], $postedToken)) { unset($_SESSION["form_token"]); return true; } return false; }

The code that calls the function to check if valid $_POST or page refresh

if ($_SERVER['REQUEST_METHOD'] === "POST") { # ensure valid $_POST from form submission and not just page refresh $isPostNotPageRefresh = isFormPostNotPageRefresh($_POST["token"]); # if this is a page refresh and not a post then exit if ($isPostNotPageRefresh) { // run your form processing php code as this is a valid $_POST and not page refresh } else { exit(); } }