<p>In the context of the <a href="https://github.com/craftcms/contact-form/" rel="nofollow noreferrer">Contact Form</a> plugin, the <a href="https://craftcms.com/docs/templating/filters#hash" rel="nofollow noreferrer">|hash</a> filter is only necessary if you want to <a href="https://github.com/craftcms/contact-form/tree/v1#dynamically-adding-email-recipients-requires-craft-25" rel="nofollow noreferrer">dynamically add recipients</a> to the submission.</p>

<p>It is there to ensure that data isn't tampered with between the time it is submitted and the time that it hits Craft.  Contact Form cares about this so malicious people/scripts don't turn your Craft install into an email SPAM relay machine.</p>

<p>Looks like you're using it on the hidden <code>redirect</code> parameter... it's completely unnecessary there, so you can remove it.</p>

CC BY-SA 3.0
2017-08-03T23:51:51.700Z
Thanks for the help, Brad. I only used `hash` on the `redirect` as it was included in the docs—I'm still not certain how it's meant to be implemented since it's prepended to the URL (throwing off the template parsing?). But at least my form is back on track!
Roger Wilco
CC BY-SA 3.0
2017-08-03T19:38:55.203Z
2017-08-03T19:38:55.203Z
Brad Bell
<p>I'm running into some trouble using the "hash" filter in Craft's first-party Contact Form plugin. The docs suggest using it like so:</p>

<pre><code>&lt;input type="hidden" name="redirect" value="{{ 'contact/thanks?from={fromName}'|hash }}"&gt;
</code></pre>

<p>On my development site, this is redirecting an otherwise-successful form to <code>domain.com/hash_valuecontact/thanks?from=name</code>, and therefore a 404 page.</p>

<p>Changing the value to <code>'/contact/thanks?from{fromName}'|hash</code> results in a more proper URL (<code>domain.com/hash_value/contact/thanks?from=name</code>) but still a 404. The docs suggest the hash is prepended to the value so the URL is expected but I'm not sure how the hash is decoded. And since the name is sent via the query string, I'm not sure what the hash is really doing in the first place, or why it's important.</p>

<p>So my question—is the hash actually important in this context, and if so how is it implemented? The docs don't contribute much information there. Thanks for any help.</p>

<plugin-contactform><hash>
How does "hash" work in the context of the Contact Form?
# How does "hash" work in the context of the Contact Form?

(Asked by: username_0 on 2017-08-02)

I'm running into some trouble using the "hash" filter in Craft's first-party Contact Form plugin. The docs suggest using it like so:


On my development site, this is redirecting an otherwise-successful form to domain.com/hash_valuecontact/thanks?from=name, and therefore a 404 page.
Changing the value to '/contact/thanks?from{fromName}'|hash results in a more proper URL (domain.com/hash_value/contact/thanks?from=name) but still a 404. The docs suggest the hash is prepended to the value so the URL is expected but I'm not sure how the hash is decoded. And since the name is sent via the query string, I'm not sure what the hash is really doing in the first place, or why it's important.
So my question—is the hash actually important in this context, and if so how is it implemented? The docs don't contribute much information there. Thanks for any help.

**Tags:** plugin-contactform, hash

---

## 1 answers

### Answer by username_1 on 2017-08-03. Score: 1 | Accepted answer

In the context of the [Contact Form](https://github.com/craftcms/contact-form/) plugin, the [|hash](https://craftcms.com/docs/templating/filters#hash) filter is only necessary if you want to [dynamically add recipients](https://github.com/craftcms/contact-form/tree/v1#dynamically-adding-email-recipients-requires-craft-25) to the submission.

It is there to ensure that data isn't tampered with between the time it is submitted and the time that it hits Craft. Contact Form cares about this so malicious people/scripts don't turn your Craft install into an email SPAM relay machine.

Looks like you're using it on the hidden `redirect` parameter... it's completely unnecessary there, so you can remove it.

> **Comments:**
> **username_0**: Thanks for the help, Brad. I only used `hash` on the `redirect` as it was included in the docs—I'm still not certain how it's meant to be implemented since it's prepended to the URL (throwing off the template parsing?). But at least my form is back on track!  

---

