Answers.Body: <p>If you're posting to Craft's <code>EntriesController-&gt;saveEntry()</code>, then it doesn't do any hash validation.</p>
  
  <p>You'd need to post to a controller of your own (from a plugin or module if you're on Craft 3), then validate the data yourself like the example in the docs you linked to:</p>
  
  <pre><code>$foo = Craft::$app-&gt;request-&gt;getPost('foo');
  $foo = Craft::$app-&gt;security-&gt;validateData($foo);
  
  if ($foo !== false) {
      // data is valid
  }
  </code></pre>
  
  <p>Then your controller would manually save the entry similar to how Craft does after your validation.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-10-20T03:36:33.233Z
Answers.Text: Ah, I see. Is there an easy way to extend the default controller? I'm still relying on several of the default user permission checks. I don't know a ton about plugin development and I want to keep this as simple as possible.
Answers.UserDisplayName: Simon Kuran
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-10-22T17:13:04.853Z
Answers.Text: Not without doing some custom plugin/module development.
Answers.UserDisplayName: Brad Bell
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-10-20T03:22:46.093Z
Answers.LastActivityDate: 2018-10-20T03:22:46.093Z
Answers.UserDisplayName: Brad Bell
Body: <p>I have a front end form for entry creation. I have a few options I don't want tampered with. <a href="https://docs.craftcms.com/v3/dev/filters.html#hash" rel="nofollow noreferrer">The docs for |hash say</a> "<em>Prefixes the given string with a keyed-hash message authentication code (HMAC), for securely passing data in forms that should not be tampered with.</em>"</p>
  
  <p>I've tried a dropdown field:</p>
  
  <pre><code>&lt;input type="hidden" name="fields[businessStatus][]" value="{{ 'created'|hash }}"&gt;
  </code></pre>
  
  <p>When <code>|hash</code> is added the page just reloads instead of going to the correct redirect URL. So I tried a plain text field with <code>|hash</code> and a hashed string is submitted instead of the string before the filter. I'm guessing this is why the page reloads for the dropdown field, what's being submitted doesn't match one of the field's values.</p>
  
  <p>What am I doing wrong? Am I misunderstanding how <code>|hash</code> works?</p>
  
  <p>Also, it says "<em>Prefixes the given <strong>string</em></strong>", what if you need to protect a integer?</p>
  
Tags: <templating><form><security><frontend-form>
Title: hashing form fields to prevent tampering
ThreadText: # hashing form fields to prevent tampering
  
  (Asked by: username_0 on 2018-10-20)
  
  I have a front end form for entry creation. I have a few options I don't want tampered with. [The docs for |hash say](https://docs.craftcms.com/v3/dev/filters.html#hash) "*Prefixes the given string with a keyed-hash message authentication code (HMAC), for securely passing data in forms that should not be tampered with.*"
  
  I've tried a dropdown field:
  
  ```
  <input type="hidden" name="fields[businessStatus][]" value="{{ 'created'|hash }}">
  
  ```
  
  When `|hash` is added the page just reloads instead of going to the correct redirect URL. So I tried a plain text field with `|hash` and a hashed string is submitted instead of the string before the filter. I'm guessing this is why the page reloads for the dropdown field, what's being submitted doesn't match one of the field's values.
  
  What am I doing wrong? Am I misunderstanding how `|hash` works?
  
  Also, it says "*Prefixes the given **string***", what if you need to protect a integer?
  
  **Tags:** templating, form, security, frontend-form
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2018-10-20. Score: 1 | Accepted answer
  
  If you're posting to Craft's `EntriesController->saveEntry()`, then it doesn't do any hash validation.
  
  You'd need to post to a controller of your own (from a plugin or module if you're on Craft 3), then validate the data yourself like the example in the docs you linked to:
  
  ```
  $foo = Craft::$app->request->getPost('foo');
  $foo = Craft::$app->security->validateData($foo);
  
  if ($foo !== false) {
      // data is valid
  }
  
  ```
  
  Then your controller would manually save the entry similar to how Craft does after your validation.
  
  > **Comments:**
  > **username_0**: Ah, I see. Is there an easy way to extend the default controller? I'm still relying on several of the default user permission checks. I don't know a ton about plugin development and I want to keep this as simple as possible.  
  > **username_1**: Not without doing some custom plugin/module development.  
  
  ---
  
  