Found something about this :
Here's the best way (that I've found) to get the size of a remote file. Note that HEAD requests don't get the actual body of the request, they just retrieve the headers. So making a HEAD request to a resource that is 100MB will take the same amount of time as a HEAD request to a resource that is 1KB.

<?php/** * Returns the size of a file without downloading it, or -1 if the file * size could not be determined. * * @param $url - The location of the remote file to download. Cannot * be null or empty. * * @return The size of the file referenced by $url, or -1 if the size * could not be determined. */function curl_get_file_size( $url ) {  // Assume failure.  $result = -1;  $curl = curl_init( $url );  // Issue a HEAD request and follow any redirects.  curl_setopt( $curl, CURLOPT_NOBODY, true );  curl_setopt( $curl, CURLOPT_HEADER, true );  curl_setopt( $curl, CURLOPT_RETURNTRANSFER, true );  curl_setopt( $curl, CURLOPT_FOLLOWLOCATION, true );  curl_setopt( $curl, CURLOPT_USERAGENT, get_user_agent_string() );  $data = curl_exec( $curl );  curl_close( $curl );  if( $data ) {    $content_length = "unknown";    $status = "unknown";    if( preg_match( "/^HTTP\/1\.[01] (\d\d\d)/", $data, $matches ) ) {      $status = (int)$matches[1];    }    if( preg_match( "/Content-Length: (\d+)/", $data, $matches ) ) {      $content_length = (int)$matches[1];    }    // http://en.wikipedia.org/wiki/List_of_HTTP_status_c...     if( $status == 200 || ($status > 300 && $status <= 308) ) {      $result = $content_length;    }  }  return $result;}?>

Usage:

$file_size = curl_get_file_size( "http://abc.com/questions/2602612/php-remote-file-size-without-downloading-file" );

Source: 

PHP: Remote file size without downloading file

2 - disable the submit button once the user has submitted the form, using JavaScript. That is what, for example
3 - Include a unique token on each POST worked for me. However, my form still submits when a user refreshes the page (F5). I managed to solve this by adding a reset:

            // reset session token
            $_SESSION['token'] = md5( $_POST['token'] . time() );

my final scripts goes like:

if (isset($_SESSION['token'])) {
    if (isset($_POST['token'])) {
        if ($_POST['token'] != $_SESSION['token']) {
            echo '<h3>Oops! You already submitted this request.</h3>';
        } else {
            // process form
            // reset session token
            $_SESSION['token'] = md5( $_POST['token'] . time() );
        }
    } else {
        echo 'post token not set';
        $_SESSION['token'] = md5( $somevariable . time() );
    }
}

oh! don't forget to add session_start(); before <!DOCTYPE>
I am a PHP newbie so please correct me if you find irregularities.


Source:
How to prevent multiple inserts when submitting a form in PHP?