CODEWITHSUNDEEP
cakephp
alxyzc
alxyzc

Reputation: 1051

Passing variable from view to controller with POST in CakePHP

I'm new to CakePHP, and am trying to do some blog-like exercise, then I ran into some problems.

See have a Model called Post, then under the PostsController I generated a view action for checking a single blog post. What I want is to allow the users to be able to add comment to the post in the Posts/view page instead of being redirected to a new Comments/add page. To do that I need to tell my CommentsController which post the user is commenting on. So wrote this in my /app/View/Posts/view.ctp:

<?php

echo $this->Form->create('Comment', array('controller' => 'comments', 'action' => 'add');
echo $this->Form->input('content', array('row' => '3'));

// this is the line I'm not sure about
echo $this->Form->input('post_id', array('default' => $post['Post']['id'], 'type' => 'hidden'));

echo $this->Form->end('Submit');

?>

Now this solution will send the value of $post['Post']['id'] to the add action in CommentsController in the form of $this->request->data['post_id'], but call me anal, I worry that whether this is the correct, or "professional" way to do this, since one can easily make the hidden field visible by altering some attributes with "inspect element' inside of any modern browser, leaving not necessarily potential security vulnerabilities, but something I personally don't feel comfortable with. So please, if anyone's worked with CakePHP before, share some experience with me on that.

Upvotes: 2

Views: 5512

Answers (1)

floriank
floriank

Reputation: 25698

First you can shorten that line to:

$this->Form->hidden('post_id', array('value' => $post['Post']['id']));

To prevent form tampering use the security component. It will:

  • Restricting which HTTP methods your application accepts.
  • CSRF protection.
  • Form tampering protection
  • Requiring that SSL be used.
  • Limiting cross controller communication.

Also I would validate that any data that is processed is valid. So you might want to check that the post exists and is public as well for example to prevent people can add comments to a non-public post. The same concept applies for everything: Never trust any input, not user nor API. Always validate the data and circumstances.

Upvotes: 3

Related Questions