I have a tag pair that generates a form. I am trying to pass some sensitive information in the tag params, trying to think of a way to avoid exposing it by showing it via hidden field.

For example, let's say I have data A and data B.

{exp:foo:bar A="foo" B="bar"}

I don't want it to be defined in the form as raw data.

<input type="hidden" name="A" value="foo">
<input type="hidden" name="B  value="bar">

I don't want users to be able to tinker and change the value in the markup. It is a exploitable.

What is the best practice that EE does for this? Encryption? I do see some addons have a hidden field where the value is a long character string.


Mathods is dependet on how sensitive this data for you:

  1. Yes, you can encrypt this data using openssl-encrypt for example (for php >=5.3), but if user have enough time and is transparent what data you keep in this encrypted message, user can find way to decrypt. Needs to add salt. Salt needs to keep somewhere.

  2. So I think more secure solutions is keep sensitive form data in the DB - add record at the moment when you create form. In form you will have only reference (better do some uniq key, not just id) to record. After n-minutes mark records as expired (or delete it).


If the form is submitted to the same template (e.g. not to a module action-id) then you don't have to expose the data at all on the page to the user.

After posting the form, your template tag is called again. You can handle the form data and at the same time, the tag parameters are available.

add-on tips

  • Make sure the parameter data does not contain the same quote marks as are used for the parameter itself. e.g. only use single quotes inside double quoted parameters var="...foo'bar'..."

  • Another option is to stuff the data into a tagpair {var}data{/var} and grab it from there via the template library or via some regex out of the tag data.

  • A good practice is post/redirect/get (wikipedia). This prevents multiple submits to a form when a user reloads the page. For instance, when a form sits on /group/template you can post to /group/template/save/ and after success redirect back. The extra (dummy) segment can be helpful in this procedure.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.