It's the type="submit", but only indirectly.
The real problem is your Validate() function.
You *DO* correctly code
return Validate() in the <form> tag, but then you never do a
return false from that function!
When you don't return any particular value from Validate(), you have ONLY a 1 in 4 billion chance that the form will *not* submit, or in other words near certainty that it will.
So you need:
Code:
function Validate() {
var value = readCookie('TestCookie');
if ( value == 1 && document.validate.drugid.selectedIndex == 5 )
{
redirect();
return false;
}
... and then maybe you need return false here as well...