I have a front end form for entry creation. I have a few options I don't want tampered with. The docs for |hash say "Prefixes the given string with a keyed-hash message authentication code (HMAC), for securely passing data in forms that should not be tampered with."

I've tried a dropdown field:

<input type="hidden" name="fields[businessStatus][]" value="{{ 'created'|hash }}">

When |hash is added the page just reloads instead of going to the correct redirect URL. So I tried a plain text field with |hash and a hashed string is submitted instead of the string before the filter. I'm guessing this is why the page reloads for the dropdown field, what's being submitted doesn't match one of the field's values.

What am I doing wrong? Am I misunderstanding how |hash works?

Also, it says "Prefixes the given string", what if you need to protect a integer?

1 Answer 1


If you're posting to Craft's EntriesController->saveEntry(), then it doesn't do any hash validation.

You'd need to post to a controller of your own (from a plugin or module if you're on Craft 3), then validate the data yourself like the example in the docs you linked to:

$foo = Craft::$app->request->getPost('foo');
$foo = Craft::$app->security->validateData($foo);

if ($foo !== false) {
    // data is valid

Then your controller would manually save the entry similar to how Craft does after your validation.

  • Ah, I see. Is there an easy way to extend the default controller? I'm still relying on several of the default user permission checks. I don't know a ton about plugin development and I want to keep this as simple as possible. Commented Oct 20, 2018 at 3:36
  • Not without doing some custom plugin/module development.
    – Brad Bell
    Commented Oct 22, 2018 at 17:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.