Naming the submit button isn't enough, since people can submit forms by hitting Enter on a text field, in which case the named submit button isn't referenced. What I do is include a hidden field called submitted and then check for that:
since people can submit forms by hitting Enter on a text field, in which case the named submit button isn't referenced.
Just FWIW, last I heard, only IE does that. The other browsers will send a submit argument.
As for what to do to avoid that, I either check that the request is POST, or check for a required param's existence. If the request does something that is not read-only (like the OP's script seems to do), I'd very strongly consider changing the form submission to POST from GET.
If the request does something that is not read-only (like the OP's script seems to do), I'd very strongly consider changing the form submission to POST from GET.
I don't see how that has anything to do with this case -- except that the OP is missing a redirect.
As it is now, if the user reloads the page, the form will get re-submit (and the file modified) without a single warning. If the method is a POST, the browser will at least warn the user that he may not want to do the reload.
I often use CGI::Minimal to see what is going on with form inputs. It has a handy function called "calling_parms_table()" which returns a HTML table of all form and environment variables. It will show you what happens when you hit Enter instead of pressing the button - the result seems to vary across different browsers. This becomes important if, say, you had two buttons on the form: make_changes and undo_changes.
Don't worry, I'm glad that using the enter key has been brought up in this discussion since not everyone uses just the buttons presented. I forgot to take that into consideration, and I use the enter key to submit data a lot of the time. I should have thought of it when posting the original post of this discussion.