Simple PHP Post-Redirect-Get code example

I would like to introduce you to a method that is often used on a greater scale and in much more detail in frameworks.

What we are going to do

We have a file called index.php.

• We are going to submit a form
• We are going to check for this submit
• We will add the POST data to a session
• We will redirect the user to a confirmation page
• We will display the data and let the user confirm.
• We will submit, and finally process the data.
• We will redirect back to index.php and show a notification.

The code

<?php
if (!isset($_SESSION)) session_start();

if ($_SERVER['REQUEST_METHOD'] == 'POST') {
    switch ($_POST['submit']) {
        case 'add':
            // This is where our first POST will end up
            // We can perform actions such as checking the data here

            // After that we will add the POST data to a session
            $_SESSION['postdata'] = $_POST;
            // and unset the $_POST afterwards, to prevent refreshes from resubmitting.
            unset($_POST);

            // Now we will redirect...
            header("Location: ".$_SERVER['PHP_SELF']);
            break;
        case 'confirm':
            // We can now insert the data into the database or email it

            // Then we will unset the session and redirect back
            unset($_SESSION['postdata']);

            // This is to display our notification
            $_SESSION['success'] = true;

            // And there we go again...
            header("Location: ".$_SERVER['PHP_SELF']);
            break;
    }
    // We will exit here because we don't want the script to execute any further.
    exit;
}
?>

<?php if (isset($_SESSION['success']) && $_SESSION['success'] == true): ?>
    <p>Our data has been processed succesfully</p>
    <?php unset($_SESSION['success']); ?>
<?php endif; ?>

<?php if (isset($_SESSION['postdata'])): ?>
    <p>
        You want to add the following data:<br />
        <pre><?php print_r($_SESSION['postdata']); ?></pre>
        Is this correct?<br />
        <form method="POST" action="<?= $_SERVER['PHP_SELF']; ?>">
            <button type="submit" name="submit" value="confirm">Yes</button>
        </form>
    </p>
<?php else: ?>
    <p>
        <form method="POST" action="<?= $_SERVER['PHP_SELF']; ?>">
            <input type="text" name="..."><br />
            <input type="text" name="..."><br />
            <input type="text" name="..."><br />
            <input type="text" name="..."><br />
            <button type="submit" name="submit" value="add">Add something</button>
        </form>
    </p>
<?php endif; ?>

A snippet of code:

if (count($_POST)) {
    // process the POST data
    // your code here- so for example to log a user in, register a new account..
    // ...make a payment...etc

    // redirect to the same page without the POST data, including any GET info you
    // want, you could add a clause to detect whether processing the post data has 
    // been successful or not, depending on your needs

    $get_info = "?status=success";

    // if not using rewrite
    // header("Location: ".$_SERVER['PHP_SELF'].$get_info);

    // if using apache rewrite
    header("Location: ".$_SERVER['REQUEST_URI'].$get_info);
    exit();
}

    Browser
   HTML form
  method=POST
       |
       v
    PHP app
  reads $_POST
sends 303 header
       |
       v
    Browser
receives header
 redirected to
   new page
       |
       v
    PHP app
  reads $_GET
 does whatever

A common use is in login authentication. That's the process flow when user submits the login form. PHP app authenticates user via $_POST vars. Sends a 303 header back to browser when the user has successfully authenticated. So user is redirected to a new page.

Simplest scenario:

if ($_POST) {
   // Execute code (such as database updates) here.

   // Redirect to this page.
   header( "Location: {$_SERVER['REQUEST_URI']}", true, 303 );
   exit();
}

Use REQUEST_URI. Do not use PHP_SELF as in most CMS systems and frameworks PHP_SELF would refer to /index.php.