The post_id isn't known until after the post has been inserted into the database, and is figured out when the post is inserted. To put the protection there, we would have to know the post_id BEFORE inserting it, which can't be done... After inserting, we can do whatever we want with the post ID, but there is no way to adjust the information that will be sent when the user pressed "reload" on their browser and resubmits the form data. Hence the need for a independant random post ID that is generated as soon as you start writing a post (or reply).

---

Jason Rhinelander
Gossamer Threads
jason@gossamer-threads.com