How would I make a Zend_Form_Element_Hidden tag immutable?

Question

I have a value that needs to be set in the form for processing, but I do not want the user to be able to edit this value. A hidden element will mostly fit my needs, but I'm concerned a clever user could enable the hidden field and change it.

Is there a validator or setting on the Hidden element that would require the submitted form value to be the same as when the form was rendered?

I don't think setIgnore(true) fits my situation, as I do need Zend_Form to read that variable when processing the form.

Also as far as I know the setAttrib('readonly', true) will not work either as this is just an HTML setting that can easily be overridden by the client.

Answer 1

You can't rely on any data being POSTed back by a user. Even if there was some magical way to control the form, someone could still forge a POST request to your submit URL with a different value for that field if they want to. Your best bet would probably be to store the value in the session instead, or at least store the value in the session and compare it to the submitted hidden field value.