button problem?

Quick diagnosis: the page refreshes because the script regenerates and overwrites the verification key on every request, then compares the newly generated key to the posted value (so they never match). There are also two immediate bugs: the form value is being read with incorrect syntax in the original code, and the script is echoing output before attempting a redirect. Finally, using the old mysql_* functions is risky and deprecated.

Fix outline (apply in this order):

1. Call session_start() and include the DB before any output.
2. Only generate and store the random key when serving the form (GET). Do not regenerate on POST. Store it in $_SESSION (or the DB) so the submitted value can be compared reliably.
3. On POST, read the submitted value with the correct index syntax (for example $_POST['key']), compare it to the session-stored key, and only then run the update. Use prepared statements (mysqli or PDO) rather than mysql_query to avoid injection and for future compatibility.
4. After a successful update, send the HTTP Location header to redirect — but make sure no output (echo/HTML) has been sent earlier; call exit immediately after the redirect. Avoid relying on output buffering as the main fix.

Minimal skeleton (illustrative, not verbatim of prior posts):

<?php
session_start();
require 'dbc.php';

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $input = isset($_POST['key']) ? trim($_POST['key']) : '';
    if (!empty($input) && isset($_SESSION['rkey']) && $input === $_SESSION['rkey']) {
        // run a prepared UPDATE to set user_okay = 1 for the logged-in user
        // redirect here (send Location header before any output) and exit
    } else {
        // show error
    }
} else {
    // generate key, store in $_SESSION['rkey'], render captcha image that uses session value
}
?>

Notes and quick tips: do not echo the key (that defeats the captcha), ensure the session variable you use for the user matches the DB id (cast to int if numeric), and consider renaming a column called key to avoid confusion with SQL keywords. @TommyBs was correct that a redirect is needed — just ensure no prior output — and @pin8marian's suggestion had a syntax problem (the Location header must be formatted correctly).