Prevent Multiple Form Submissions (Server side) I'm running into a problem where a user can submit any form built by the Form API multiple times (fast clicking resulting in multiple requests).

I've put in the basic client side (javascript) solution of disabling the button, but I'm curious what the best approach to preventing this situation is on the server side.

Is there a recommended way to use Drupal's form token system to handle this?  Especially a global form solution (ie, adding a custom validator to every form using hook_form_alter()).

My approach so far has been something like this:

function mymodule_form_alter(&amp;$form, &amp;$form_state, $form_id) {
  $form['#validate'][] = 'mymodule_form_validate';
}

function mymodule_form_validate(&amp;$form, &amp;$form_state){
  //initialize form array
  if (!isset($_SESSION['submitted_forms'])){
    $_SESSION['submitted_forms'] = array();
  }

  $form_token = $form_state['values']['form_token'];
  if ( isset($_SESSION['submitted_forms'][$form_token]) &amp;&amp; $_SESSION['submitted_forms'][$form_token] = TRUE ){
    form_set_error('name]', 'This form has already been submitted');
  }
  else{
    $_SESSION['submitted_forms'][$form_token] = TRUE;
  }
}


I'm running into trouble where the form_token isn't unique to the form - it seems to stay the same no matter what happens.  I'm probably misunderstanding what the token is in the grand scheme of the form api.

Any insight is appreciated!
I had the exact same problem and managed to fix it using the Locking mechanisms from Drupal

In the validate function I used:

function mymodule_custom_form_validate($form, &amp;$form_state){
  if (lock_acquire('your_custom_lock_name')) {
    // long operations here
  } else {
    form_set_error("", t("You submitted this form already."));
  }
}


And in the submit function I released the lock:

function mymodule_custom_form_submit($form, &amp;$form_state){
  // submit code
  lock_release('your_custom_lock_name');
}