I'm using an older EE2 addon that doesn't appear to have support for secure forms. Does anyone know how to add the hidden XID hash field to the form via the addon code?

I guess I'm really looking to see if there's a code snippet that would just create the hash itself that I can add within the addon file.

UPDATE: After looking more closely at the addon code, it's using the form helper so what I need is something like:

form_hidden('XID', 'xid outputted value')

which would generate the following:

<input type="hidden" name="XID" value="the xid hash">



3 Answers 3


EE Docs. Also details Ajax handling of XID.

As Bhashkar stated:


Or the new method:


"so the XID (secure hash ID) is added automatically as a hidden input field."

As part fo the $data array sent you can force secure by adding it:

$data['secure'] = TRUE;

Example of complete code:

$formDetails = array('action'     => '',
              'name'           => 'filtered_listing',
              'id'             => $this->EE->TMPL->form_id,
              'class'          => $this->EE->TMPL->form_class,
              'hidden_fields'  => array('ACT' => $actionID,
                                        'RET' => $_SERVER["REQUEST_URI"]),
              'secure'         => TRUE
$header = $this->EE->functions->form_declaration($formDetails);

If you're checking the receipt of the form and need to validate the XID...

//###   Check Security Hash   ###
if ($this->EE->security->secure_forms_check($this->EE->input->post('XID')) == FALSE) {
    //###   Deny Form submission if a hash isn't found or is too old
    $this->EE->functions->redirect(stripslashes($this->EE->input->get_post('RET', false)));

Update based on Form Helper example code

Try Outputting {XID_SECURE_HASH} Reference

form_hidden('XID', '{XID_SECURE_HASH}')

Failing that:

form_hidden('XID', $this->EE->functions->add_form_security_hash('{XID_HASH}'));

Ref: Rob Sanchez

Form Helper Documentation

  • Thanks Peter - this is a great answer but unfortunately the addon I'm editing doesn't use this method (see my updated question for details). Commented Oct 7, 2013 at 11:51
  • Answer updated with add_form_security_hash method Commented Oct 7, 2013 at 15:40
  • Hi Peter, I can confirm that form_hidden('XID', $this->EE->functions->add_form_security_hash('{XID_HASH}')); worked for me! Thanks so much. Commented Oct 7, 2013 at 19:27

I think, the addon may be generating the form with the following code:

$hidden_fields = array(
    'ACT'       => 'ACTION ID',
    'RET'       => 'RETURN URL'

$data = array(
    'action'        => 'FORM ACTION',
    'hidden_fields' => $hidden_fields,
    'id'            => 'FORM ID',

$tagdata = $this->EE->TMPL->tagdata;
$form  = $this->EE->functions->form_declaration($data);
$form .= stripslashes($tagdata);
$form .= "</form>";

which automatically generates XID as form's hidden field.

If above doesn't help, can you share the addon's code which is creating form.

  • Thanks Bhashkar. The addon I'm editing is using the form helper rather than the method you've outlined here. It seems I just need some code that will generate a valid xid hash within the addon file. Commented Oct 7, 2013 at 11:50

If you just create a hidden input field name XID and use the EE Tag {XID_HASH} I think it'll generate the value for you.

<input type="hidden" name="XID" value="{XID_HASH}" />
  • That's true, but the code is within an old addon that doesn't use functions->form_declaration($data) (which would create the xid hash automatically). Commented Oct 7, 2013 at 11:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.