The way I've handle this situation in the past is to POST directly to vote.cgi. vote.cgi then records the vote and who voted (by either cookie, or some other tracking means). vote.cgi then sends a redirect header back to index.shtml.

When index.shtml includes vote.cgi again, the script should realize that the user has already voted and will post only the results.

some pseudocode:

# ...

$action = $query->param('action');
$voted = hasuservoted();

if ($action eq "show")
    $voted ? show_results() : show_poll();
}
elsif ($action eq "vote" && !$voted) {
    vote();
}
else {
    error("no valid action");
}

sub show_poll {

    # display the poll so the user can fill it in.

}

sub show_results {

    # show the poll results -- user can no longer vote

}

sub vote {
    
    # record the user's vote
    # record who voted
    # redirect to index.shtml
}

sub hasuservoted {

    # returns 1 if user has voted
    # returns 0 if user has no voted

}
[download]

Something like that. In index.shtml you'd include vote.cgi?action=show. Your poll html should include the hidden field <input type="hidden" name="action" value="vote">.

HTH.