表单提交后,Mysql插入查询在下载时运行很多次

时间:2016-08-03 08:12:41

标签: php mysql csrf

当我尝试使用下载管理器下载时,Mysql会运行多次。

if(isset($_POST["fname"]) &&  isset($_SESSION['token']) && $_POST["token"] == $_SESSION['token']){
        // after submit it runs two times
        $sql = "INSERT INTO testpage SET
        username = 'test',
        name = 'xyz'

        ";
        if(!mysqli_query($db_conx, $sql)){
        echo mysqli_error($db_conx);
        exit; 
        }

        $fullPath = 'user/pdf/xyz.pdf';//let the path is this
        $basefile_name = "abcd" ;
        header('Content-Description: File Transfer');
        header('Content-Type: application/octet-stream');
        header('Content-Disposition: attachment; filename=' . basename($basefile_name.".pdf"));
        header('Content-Transfer-Encoding: binary');
        header("Cache-Control: no-cache, no-store, must-revalidate"); // HTTP 1.1.
        header("Pragma: no-cache"); 
        header('Expires: 0');
        header('Content-Length: ' . filesize($fullPath));
        ob_clean();
        flush();
        readfile($fullPath);
        exit; 
    }
if (function_exists('mcrypt_create_iv')) {
        $token = bin2hex(mcrypt_create_iv(32, MCRYPT_DEV_URANDOM));
    } else {
        $token = bin2hex(openssl_random_pseudo_bytes(32));
    }
    $_SESSION['token'] = $token;

和html部分是

<div class="container">
                <form  method="post">
                    First name: <input type="text" name="fname"><br><br>
                    Last name: <input type="text" name="lname"><br>
            <input type="hidden" name="token" value="<?php echo $token; ?>">
                    <input type="submit" value="Submit">
                </form>
            </div>

即使在我错了添加令牌后仍然存在问题。 提前。 php mysql。

0 个答案:

没有答案