<p>If you're posting to Craft's <code>EntriesController-&gt;saveEntry()</code>, then it doesn't do any hash validation.</p>

<p>You'd need to post to a controller of your own (from a plugin or module if you're on Craft 3), then validate the data yourself like the example in the docs you linked to:</p>

<pre><code>$foo = Craft::$app-&gt;request-&gt;getPost('foo');
$foo = Craft::$app-&gt;security-&gt;validateData($foo);

if ($foo !== false) {
    // data is valid
}
</code></pre>

<p>Then your controller would manually save the entry similar to how Craft does after your validation.</p>

CC BY-SA 4.0
2018-10-20T03:36:33.233Z
Ah, I see. Is there an easy way to extend the default controller? I'm still relying on several of the default user permission checks. I don't know a ton about plugin development and I want to keep this as simple as possible.
Simon Kuran
CC BY-SA 4.0
2018-10-22T17:13:04.853Z
Not without doing some custom plugin/module development.
Brad Bell
CC BY-SA 4.0
2018-10-20T03:22:46.093Z
2018-10-20T03:22:46.093Z
Brad Bell
<p>I have a front end form for entry creation. I have a few options I don't want tampered with. <a href="https://docs.craftcms.com/v3/dev/filters.html#hash" rel="nofollow noreferrer">The docs for |hash say</a> "<em>Prefixes the given string with a keyed-hash message authentication code (HMAC), for securely passing data in forms that should not be tampered with.</em>"</p>

<p>I've tried a dropdown field:</p>

<pre><code>&lt;input type="hidden" name="fields[businessStatus][]" value="{{ 'created'|hash }}"&gt;
</code></pre>

<p>When <code>|hash</code> is added the page just reloads instead of going to the correct redirect URL. So I tried a plain text field with <code>|hash</code> and a hashed string is submitted instead of the string before the filter. I'm guessing this is why the page reloads for the dropdown field, what's being submitted doesn't match one of the field's values.</p>

<p>What am I doing wrong? Am I misunderstanding how <code>|hash</code> works?</p>

<p>Also, it says "<em>Prefixes the given <strong>string</em></strong>", what if you need to protect a integer?</p>

<templating><form><security><frontend-form>
hashing form fields to prevent tampering
# hashing form fields to prevent tampering

(Asked by: username_0 on 2018-10-20)

I have a front end form for entry creation. I have a few options I don't want tampered with. The docs for |hash say "Prefixes the given string with a keyed-hash message authentication code (HMAC), for securely passing data in forms that should not be tampered with."
I've tried a dropdown field:


When |hash is added the page just reloads instead of going to the correct redirect URL. So I tried a plain text field with |hash and a hashed string is submitted instead of the string before the filter. I'm guessing this is why the page reloads for the dropdown field, what's being submitted doesn't match one of the field's values.
What am I doing wrong? Am I misunderstanding how |hash works?
Also, it says "Prefixes the given string", what if you need to protect a integer?

**Tags:** templating, form, security, frontend-form

---

## 1 answers

### Answer by username_1 on 2018-10-20. Score: 1 | Accepted answer

If you're posting to Craft's EntriesController->saveEntry(), then it doesn't do any hash validation.
You'd need to post to a controller of your own (from a plugin or module if you're on Craft 3), then validate the data yourself like the example in the docs you linked to:
$foo = Craft::$app->request->getPost('foo');
$foo = Craft::$app->security->validateData($foo);

if ($foo !== false) {
    // data is valid
}

Then your controller would manually save the entry similar to how Craft does after your validation.

> **Comments:**
> **username_0**: Ah, I see. Is there an easy way to extend the default controller? I'm still relying on several of the default user permission checks. I don't know a ton about plugin development and I want to keep this as simple as possible.  
> **username_1**: Not without doing some custom plugin/module development.  

---

