| [reply] |
A "real" HTTP redirect has to be in the header, not in the page BODY. You could use a <META> refresh or/and a javascript one which will work for most.
It depends on how long it takes to process your form data. If it can vary a lot than this is probably not the best solution. Impatient people might hit refresh submitting duplicates to your form.
There's a lot of ways to do it, (server push, refreshes, etc)
Are you putting the results into a file? If so I would opt for something simple like this. Make sure you use Taint.
The script that processess the form post does the following.
- Check for a param() named resultsid. (This is a unique tmp file name. (There's modules for this)
- If it exists...
- Read in the file (Make sure to untaint resultsid first!).
- If the first line says <!--done--> then don't print out a META refresh and print out the text you read in the file, exit (or return) because your done.
- If the first line doesn't says <!--done--> then print out a META refresh to self_url() with a reasonable amount of time for the next refresh and print out the text you read in the file..
-
- If the param resultsid doesn't exist create one.
- Open the file (Make sure to untaint this first!)
- Print out the "Please wait" HTML to the resultsid temp file.
- print out a redirect to self_url() (Which by now will contain resultsid because you set it using CGI param() function.
- Continue processing the form. When done, print to the resultsid file the desired contents and make sure to put your <!--done--> comment in the first line.
One caveat is that if you have a lot of form data, the self_url() returned by CGI.pm may get truncated by the browser. If that's the case, you could make the url by hand. (Only need the resultsid parameter.)
IMHO the benefits of this is that it is fairly agnostic of the server and browser and you could reuse it pretty easily for other forms like this by changing the function that processes the form and prints the output. This method makes it hard for the user to duplicate the form post by clicking Refresh or Reload because they are instantly moved to a different url. There are other ways of doing this as well but this down and dirty way will suffice for most apps.
You could also have this the same script that prints out the form as well. Just check for any param() and if there none, print out the form. Do this before the logic that looks for the resultsid.
-Lee
"To be civilized is to deny one's nature."
| [reply] |
