Multipage Registration form, Confirmation Page Security Issues? I have a multipage registration form working on a site, but the confirmation page is supposed to show some of the information (account name and other data) after the account has been submitted/created. I can treat this confirmation page as the last page of the multipage form, but I'm concerned that the user can then press the back button on the browser, the session data will still be there, and they can then re-submit the same data again.

Another approach would be to end the session and display the data on a redirect page, but I could not find how Drupal 7 would pass this form data to the redirect page. There would be too much data to put it in the URL.

Does anyone have a suggested Drupal 7 method to achieve a confirmation page showing session data, but not allow the user to press back on the browser and re-submit the form again?
After further investigation, it appears that one option is to make a confirmation page that is called after the form does it's final submission. Essentially, somewhere in the form alter or form functions near the end (after database operations), add a variable to PHP's $_SESSION array that contains the Drupal form ID (a long string of random characters), and add to this array another sub-array that contains all the information you want shown on the confirmation page.

Then, in the confirmation function (or page if you want to do the .tpl.php version), pass the form ID as a variable in the url. Then use this form ID to get the array from the $_SESSION array and retrieve the information.

As an example, see the drupal_set_message() function since it too uses the PHP $_SESSION variable to pass information back to the user on the next page load.

To keep the user from using the browser-back button and resubmitting the same information again, check the $_SESSION variable for the same form-id before committing user changes to the database and stop the attempt if the form-id's match. In some cases (e.g., registering for a new user account), Drupal will complain anyway if one tries to submit duplicate information to the database (e.g., username exists already).