Did u actually read this post?

The best course of action is just to do a redirect after POSTing data and be done with it – just accept that there are going to be people out there who will abuse how the HTTP protocol works.

Rather than using one or more other pages, after submission, I usually reuse the same page, do validation db inserts and what not.

In the top of your whatever.php place this:

session_start();

if ($_SERVER["REQUEST_METHOD"] == “POST”) {
$_SESSION["__POSTFIELDS"] = serialize($_POST);
header(”Location: ?check”);
}

else {
if (strlen($_SESSION["__POSTFIELDS"]) > 0) {
$_POST = unserialize($_SESSION["__POSTFIELDS"]);
}
}

This way, we keep track of all the postdata, and re-assign them to $_POST so we can proceed with our validation stuff, like so:

if ((isset($_GET["check"])) && (strlen($_SESSION["__POSTFIELDS"]) > 0)) {
if (strlen(trim($_POST["usr"])) < 1) {
echo “Username missing.”;
}

if (strlen(trim($_POST["pwd"])) < 1) {
echo “Password missing.”;
}
}

Also the form fields gets their values re-assigned using the appropriate post field.

In case this doesn’t make any sense, you can see my example here:
http://sandbox.datapimp.dk/post/

I must admit i haven’t tested this completely yet, so it might have one or more drawbacks

One thing to keep in mind, is that your HTTP status code should also be 303 rather than 302, so that it is standards compliant AND future safe for new browsers that may come out.

This is easily doable by modifying:

header(’Location: SUCCESSPAGE’);
to
header(’Location: SUCCESSPAGE’, true, 303);

Cheers,
Sam