I have a front end form for entry creation. I have a few options I don't want tampered with. The docs for |hash say "Prefixes the given string with a keyed-hash message authentication code (HMAC), for securely passing data in forms that should not be tampered with."

I've tried a dropdown field:

<input type="hidden" name="fields[businessStatus][]" value="{{ 'created'|hash }}">

When |hash is added the page just reloads instead of going to the correct redirect URL. So I tried a plain text field with |hash and a hashed string is submitted instead of the string before the filter. I'm guessing this is why the page reloads for the dropdown field, what's being submitted doesn't match one of the field's values.

What am I doing wrong? Am I misunderstanding how |hash works?

Also, it says "Prefixes the given string", what if you need to protect a integer?


If you're posting to Craft's EntriesController->saveEntry(), then it doesn't do any hash validation.

You'd need to post to a controller of your own (from a plugin or module if you're on Craft 3), then validate the data yourself like the example in the docs you linked to:

$foo = Craft::$app->request->getPost('foo');
$foo = Craft::$app->security->validateData($foo);

if ($foo !== false) {
    // data is valid

Then your controller would manually save the entry similar to how Craft does after your validation.

  • Ah, I see. Is there an easy way to extend the default controller? I'm still relying on several of the default user permission checks. I don't know a ton about plugin development and I want to keep this as simple as possible. – Simon Kuran Oct 20 '18 at 3:36
  • Not without doing some custom plugin/module development. – Brad Bell Oct 22 '18 at 17:13

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.