NYCPHP Meetup

[Erik Baker]

Hey All,

I wanted to start by saying how useful I find these mailing lists.  Although this is the first time that I'm submitting a question, I have found following the threads from other people's questions very valuable as I move into becoming an intermediate PHPer.

That said, I have a question regarding forms and protecting them against browser refreshes.  I have written a PHP program that emails a user's password to their registered email address upon request.  The main program looks like this:

	//HARVEST VARIABLES
	$query_msg = $_POST['query_msg'];
	$login = $_POST['login'];
	$email = $_POST['email'];
	
	//MAIN
	if (!empty($query_msg) && $query_msg != 'Password Found') { #Skip MySQL query first time form is called & after password found
		GetData();
	}

	$query_msg != 'Password Found' # Leave form only when successful
		? ShowForm() # Display the form
		: ShowSuccess($login,$email); # Show Success

~GetData() goes to a MySQL database and sets the global variable $query_msg equal to 'Password Found' if a query on their login name or email matches, and then sends an email to their address with their password.
~ShowForm() sets up an HTML form with either login or email passed (user's submission choice) and sends along $query_msg with it as a hidden input type.
~ShowSuccess() is a general message that displays when the password is found.

The problem is that someone could tinker around to find a valid user name, then keep hitting refresh and send dozens (or more) emails to that user.  GetData() is not skipped because a refresh brings back $query_msg from $_POST (which is the previous value of $query_msg) and not the global variable value of 'Password Found'.

Is there a way to set the variable directly in $_POST so that it will pass back the a newer value upon refresh?  Or is there a way to have the program call itself again and pass new POSTed variables?

***I realized setting this form up that there are probably a dozen other ways a malicious user could try to break any form.  Does there exist anywhere a "Safest Form Practices" document?  I'm sure there are other security issues that I'm not aware of that need to be guarded against.

Any help would be greatly appreciated.

Thanks,

Erik