In web development, the problem that must be addressed is the repeated submission of forms (here only refers to repeated submission caused by F5 refreshing). There seems to be no good way to deal with this problem in. net. Search
There are two solutions: one is to invalidate the form button directly, so that one user can only submit one form once; the other is, is to clear the form after a submission, in the background logic for determination
To identify whether the request is submitted repeatedly.
In my personal opinion, the first method is that the user experience is poor, and the button can only be pressed once. This should be used to prevent repeated submissions caused by multiple clicks of the submit button and prevent secondary submissions caused by refresh; in the second case, both types of repeated submissions can be prevented, but the content of the form is gone. If there is a need to prevent the content from disappearing, it will take some twists and turns.
Therefore, I imitated the struts token in JSP and wrote a method to prevent the form from being submitted repeatedly.
Implementation principle:
Since refresh the submission form, the last normal submission form is actually submitted, so we only need to make a flag, you can determine whether a new form or the last old form has been submitted repeatedly.
Implementation Method:
Place a hidden domain on the page. When the page is loaded for the first time, save a flag in the session and save the mark to the hidden on the page. Before submitting
When you determine whether the hidden signs in the form are consistent with those in the session, you can know whether the form is submitted normally or the repeated submission caused by PAGE refreshing. Note that,
After processing each submitted form, update the flag in the session.
Code example:
Few codes, first on the page.
- <HTML xmlns = "http://www.w3.org/1999/xhtml">
- <Head runat = "server">
- <Title> </title>
- </Head>
- <Body>
- <Form ID = "form1" runat = "server">
- <Div>
- <Input type = "text" id = "tbxname" runat = "server"/>
- <Input type = "text" id = "tbxpass" value = "" runat = "server"/>
- <Asp: button id = "btnsubmit" runat = "server" onclick = "button#click" text = "button"/>
- <Asp: Label id = "lblmessage" runat = "server" text = ""> </ASP: Label>
- <Input id = "hiddentest" type = "hidden" value = "<% = gettoken () %>" name = "hiddentestn"/>
- </Div>
- </Form>
- </Body>
- </Html>
Note:
1 getsessiontoken () function is used to obtain the token stored in the session.
2
Hidden uses a non-server control. This is because when I use a server control and directly obtain the session flag in the background and assign a value to this hidden, I refresh and submit it to the server.
The value of hidden in the form has also changed. If the result is a server control, the values in the form are synchronized. Of course, it may be that the method I used is incorrect.
The following is the background code:
- Using system;
- Using system. Data;
- Using system. configuration;
- Using system. Web;
- Using system. Web. Security;
- Using system. Web. UI;
- Using system. Web. UI. webcontrols;
- Using system. Web. UI. webcontrols. webparts;
- Using system. Web. UI. htmlcontrols;
- Using system. Security. cryptography;
- Using system. text;
- Public partial class _ default: system. Web. UI. Page
- {
- Protected void page_load (Object sender, eventargs E)
- {
- // An initial flag is generated during the first loading.
- If (null = session ["token"])
- {
- Settoken ();
- }
- }
- Protected void button#click (Object sender, eventargs E)
- {
- If (request. Form. Get ("hiddentestn"). Equals (gettoken ()))
- {
- Lblmessage. forecolor = system. Drawing. color. blue;
- Lblmessage. Text = "normal submission form ";
- Settoken (); // do not forget to update the flag in the session.
- }
- Else
- {
- Lblmessage. forecolor = system. Drawing. color. Red;
- Lblmessage. Text = "refresh the submission form ";
- }
- }
- // Obtain the flag saved in the current session
- Public String gettoken ()
- {
- If (null! = Session ["token"])
- {
- Return session ["token"]. tostring ();
- }
- Else
- {
- Return string. empty;
- }
- }
- // Generate a flag and save it to the session
- Private void settoken ()
- {
- Session. Add ("token", usermd5 (session. sessionid + datetime. Now. ticks. tostring ()));
- }
- // This function is purely intended to make the logo a little shorter. A bunch of garbled characters are also mysterious. In addition, this usermd5 function is readily available on the Internet.
- Protected string usermd5 (string str1)
- {
- String cl1 = str1;
- String Pwd = "";
- MD5 MD5 = md5.create ();
- // The encrypted data is a byte array.
- Byte [] S = md5.computehash (encoding. Unicode. getbytes (cl1 ));
- // Convert an array of the byte type into a string by using a loop. This string is obtained by regular character formatting.
- For (INT I = 0; I <S. length; I ++)
- {
- // Use the hexadecimal format of the obtained string. The characters in the format are lowercase letters. If uppercase letters (x) are used, the characters in the format are uppercase letters.
- Pwd = PWD + s [I]. tostring ("X ");
- }
- Return PWD;
- }
- }
Note:
1. Generate a flag when loading the page for the first time, and you will not need it later.
2. At the end of the form processing function, remember to update the flag.
3. I chose the current sessionid and the current time millisecond value. This basically avoids the mark duplication and then implements MD5 once. It is purely for the logo to be shorter, of course, a little bit secure, haha.
All the code is very simple. I don't know if it's too simple or you have a better way. I didn't find similar code on the Internet, so I will write it down and share it with you. If there is a better way, I hope I can tell you that because I haven't done Web development for a long time, I'm afraid many new technologies won't happen.
