We have a problem with users double-clicking on buttons within our application to proceed from screen to screen.

We have implemented the ( onclick="this.disabled=true" ) on our buttons but we are convinced that it is not always sufficient to stop the fast-fingered double-click.

A simple example :-

Screen A has four input fields and a proceed button. When the proceed button is pressed, control is passed to server-side routine to validate info, set some session vars and call screen B.

What appears to happen occasionally is :-

On first click the server-side routine is called and begins validating info and setting session vars. Second-click takes control and again calls the server-side routine and begins validating info and setting session vars -> for us, the session vars are already set and this highlights the problem.

We have looked at tokens but don't think they will solve our problem.

We think that since every PHP application must be vulnerable to this double-click issue there has to be a standard method for resolving it but we have yet to find one.

If you have resolved this issue then we would be grateful if you would like to give us some insights into how we might overe the problem.

* Thanks for the replies. Loic and Brian Nickel - hard to separate as both going for the token method via timestamp or GUID. We will have to go back and take another look at tokens. After discussion - as a preferred solution for us, we would go with the GUID token concept.

We have a problem with users double-clicking on buttons within our application to proceed from screen to screen.

We have implemented the ( onclick="this.disabled=true" ) on our buttons but we are convinced that it is not always sufficient to stop the fast-fingered double-click.

A simple example :-

Screen A has four input fields and a proceed button. When the proceed button is pressed, control is passed to server-side routine to validate info, set some session vars and call screen B.

What appears to happen occasionally is :-

On first click the server-side routine is called and begins validating info and setting session vars. Second-click takes control and again calls the server-side routine and begins validating info and setting session vars -> for us, the session vars are already set and this highlights the problem.

We have looked at tokens but don't think they will solve our problem.

We think that since every PHP application must be vulnerable to this double-click issue there has to be a standard method for resolving it but we have yet to find one.

If you have resolved this issue then we would be grateful if you would like to give us some insights into how we might overe the problem.

* Thanks for the replies. Loic and Brian Nickel - hard to separate as both going for the token method via timestamp or GUID. We will have to go back and take another look at tokens. After discussion - as a preferred solution for us, we would go with the GUID token concept.

• javascript
• php
• double-click

• 1 if you really want to stop the double click, use one hidden input field which will hold a auto-increment value or a hash and you can then validate the hidden value to process the form only once – Viswanath Polaki Commented Mar 4, 2014 at 13:10
• PHP should be removed from the title and tags since it is irrelevant to the question – Josef Engelfrost Commented Mar 4, 2014 at 13:42

3 Answers 3

Since double click will basically submit the same form twice you can check the timestamp between two submits.

I'll take the example of stackoverflow because this site is awesome.

Let's say I vote this question up, server side, if my POST request is valid, then my POST request will be treated, and saved.

Then server side, before treating a request, they will check if this same form hasn't been posted in last few seconds (don't they?).

Anyway, my point is, give your forms a name, and when validated, put a timestamp in your users session so you can refuse their post of the same form given a defined amount of time.

Best of luck.

This is a very mon problem with a fairly standard solution. Whenever you generate your form, you should generate a unique token like a GUID and stick it in SQL, redis, memcached, the session, or any short term persistent store you have. Stick it in a hidden field. You should be doing one token for each generated form.

When the form gets submitted, atomically check for and remove the token from the store. If it's there the form was submitted for the first time. If not, it's a duplicate.

For bonus points, instead of showing an error on the second submission, you can store the token with the successful result data and use it to render the same success page as you would have if they clicked once.

1) Put a for the eye hidden div (or other element) on z-top of button (opacity:0.01)

2) when once clicked (mousedown) remove div

or:

1) Remove click event when once clicked