I am using Profile:Edit to display a form which allows the user to update and edit their profile. However I have some custom fields which I want to protect from being changed. I am not displaying these fields to the user, but if the user was to 'hack' the page by manually inserting an input text field into the page they are viewing (using the browsers inspector tool) then they can submit any field they like and profile edit will happily update the value (I have tested this).

How can I stop Profile:Edit from updating any field it receives via POST, and only update values I give it permission to update?

Let me know if you don't get what I mean.


I'm not certain this is something you have to worry about, unless you are also somehow providing your database schema to the user as well. Generally speaking in EE a name field is rarely just called a name field, it might be called profile-name or profile_name. So if you had custom fields that you aren't displaying, then no one but you or other staff members should know what the names of the fields are.

I know we use naming protocols for field names, so that the field provides us with some basic info. Ours is simple, typically, channel_field or channel_field_type, which might look like staff_firstname or staff_firstname_text. But are labels are pretty standard, basically 'First Name'.

Though, I guess if it is still worrisome to you, you could probably add some javascript to verify the submit, only submits the fields you specifically want. You'd need to remember to update it, whenever you add or remove fields from the list though.


Another option, if this is a big security issue, is to build an extension that hooks into either Profile:Edit or the underlying Channel Form and validates the POST array before it is processed any further.

Take a look at the extension hooks available in Profile Edit and/or Channel Form and you find one that is called before the profile is updated. You can then just use the PHP unset() function to remove any offending data from the POST array.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.