Prevent multiple hitting while submitting form

There are several solutions to this problem:

1. Use Javascript to disable the form's submit button when it is posted. 
Downside to this is that this is ABSOLUTELY not a foolproof way. It's very easy to submit forms without actually clicking the button, and this would also not work for users with JavaScript disabled. 
I would definitely not recommend this method.

Example:

<script language="javascript">
<!-- function disableSubmitButton()
{ // you may fill in the blanks :) } -->
</script>
<form action="foo.php" method="post"> <input type="text" name="bar" /> <input type="submit" value="Save" onclick="disableSubmitButton();">
</form>

2. Use PHP sessions to set a session variable (for example $_SESSION['posttimer']) to the current timestamp on post. 
Before actually processing the form in PHP, check if the $_SESSION['posttimer'] variable exists and check for a certain timestamp difference (IE: 2 seconds). This way, you can easily filter out double submits.

Example:

// form.html
<form action="foo.php" method="post"> <input type="text" name="bar" /> <input type="submit" value="Save"> </form>

// foo.php

if (isset($_POST) && !empty($_POST)) {
if (isset($_SESSION['posttimer'])) { if ( (time() - $_SESSION['posttimer']) <= 2) { // less then 2 seconds since last post } else { // more than 2 seconds since last post } } $_SESSION['posttimer'] = time(); }

3.Include a unique token on each POST. In this case, you would also set a session variable to the token you want to include and then render the token in the form. Once the form is submitted, you re-generate the token. When the submitted token does not match the token in your session, the form has been re-submitted and should be declared invalid.

Example:

// form.php
<?php // obviously this can be anything you want, as long as it is unique $_SESSION['token'] = md5(session_id() . time()); ?>
<form action="foo.php" method="post"> <input type="hidden" name="token" value="<?php echo $_SESSION['token'] ?>" /> <input type="text" name="bar" /> <input type="submit" value="Save" /> </form>

// foo.php

if (isset($_SESSION['token'])) { if (isset($_POST['token'])) { if ($_POST['token'] != $_SESSION['token']) { // double submit } } }