Basically you need to use the unique SESSION value twice. Once somewhere in the form you are trying to submit and once stored in the $_SESSION variable. When the form is POSTED and both values are a match then we have a successful submission, when the form is POSTED but the values are different, no submission occurs.
I.e.:
somewhere on the top of your PHP page:
<?php
session_start(); // first line of your PHP page
$_SESSION['secretFormValue'] = isset($_SESSION["secretFormValue"]) ? $_SESSION["secretFormValue"] : md5(microtime()); // generate some unique session value
// assign submitted **secretFormValue** from your form to a local variable
$secretFormValue = isset($_POST["secretFormValue"])? filter_var($_POST["secretFormValue"], FILTER_SANITIZE_STRING) : '';
// check if the value is present in the **secretFormValue** variable
if($secretFormValue != '') {
// check if both values are the same
if($_SESSION["secretFormValue"] == $secretFormValue) {
// Process form values & submission ...
// add your own code...
unset($_SESSION["secretFormValue"]);
} else {
echo "Duplicate submission";
}
} else {
// do some other thing
}
somewhere below in your form:
<input type="hidden" name="secretFormValue" value"<?php echo $_SESSION['secretFormValue']; ?>">
***I did not test this so please comment in case there is a bug, thx.*
Edit:
If you need to prevent submit on page-refresh you may include clearing all the POST values on successful submit so the refresh would fail because of the empty POST i.e.:
unset($_POST); // place it right before unset($_SESSION["secretFormValue"]);
or
Include a redirect to a different page (i.e. Thank You Page) after submission i.e.:
header("Location:ThankYouPage.php"); // place it right after unset($_SESSION["secretFormValue"]);
or just found this one in other SO post:
https://en.wikipedia.org/wiki/Post/Redirect/Get