6

I have form which is submitted via GET method. The problem is that after submit the URL looks very bad, with lots of parameters like form_build_id & form_token. How can I get rid of them? Thanks

3
  • Why you do not use POST method ? I think some parameters like form_build_id and form_token should not be removed.
    – Sithu
    Aug 3, 2012 at 6:31
  • I have no validation & no submit functions. I just needed to add some parameters to the url, that's it Aug 3, 2012 at 9:11
  • Related: drupal.org/node/821932
    – rooby
    Oct 12, 2016 at 21:18

4 Answers 4

6

I ended up doing this:

$form = drupal_get_form('my_form_id');
unset($form['form_build_id']);
unset($form['form_id']);
unset($form['form_token']);
9
  • 1
    I'd be very careful about doing this. The docs have a comment that all three of those values are needed for form processing and validation. The last value is used to protect against CSRF so is a potential security risk (depending on what the link does). The form cache won't work without form_build_id, and I don't know what other problems might occur!
    – Andy
    Aug 3, 2012 at 8:09
  • I don't think they matter for forms submitted via GET. Anyway, I have no validation or submit functions, I just needed to add some params to the url, that's it Aug 3, 2012 at 8:47
  • 1
    It doesn't do anything, just adds the params to the url Aug 3, 2012 at 9:57
  • 1
    But presumably at some point something's using those params yeah? The question is what are they used for?
    – Andy
    Aug 3, 2012 at 10:07
  • 1
    A little late but an example of where this may be needed is when creating a custom form that is used as a 'search block'. This search block uses the 'get' method and sends the request to view. No updates or creation.
    – Amarjit
    Apr 13, 2016 at 12:28
3

These values shouldn't be needed for GET forms, but might be. Using POST instead is not a suitable fix, that has other side effects.

According to the specs:

  • GET should be used to change the content of the page displayed
  • POST should be used to pass data or instructions to the server

A POST request should therefore be treated with care, as you might use it for something like adding an answer to a question. You don't want to accidentally send that answer twice, or it will show on the site twice - that's why browsers will warn you when you reload a page that you sent POSTDATA to. You also don't want another site to pretend to be you and answer a question on your behalf (that's called XSRF or cross-site request forgery).

These variables are included to protect against these dangers of POST, but they are not necessary if you are doing a (read-only) GET request. Other advantages of using GET at that the response can be cached, bookmarked and indexed by search engines.

A final warning: although you're not meant to change anything as the result of a GET request, there's nothing stopping you from doing so. That's probably why Drupal includes this protection.

2

Following what views does with the views_exposed_form you can easily do this to hide form_build_id form_token and form_id. Considering views is one of the top contrib modules I would say this is pretty safe:

/**
 * Implement hook_form_alter for the exposed form.
 *
 * Since the exposed form is a GET form, we don't want it to send a wide
 * variety of information.
 */
function MYMODULE_form_MY_FORM_ID_alter(&$form, &$form_state) {
  $form['form_build_id']['#access'] = FALSE;
  $form['form_token']['#access'] = FALSE;
  $form['form_id']['#access'] = FALSE;
}

See views.module and views_exposed_form() and views_form_views_exposed_form_alter()

0

Following worked for me...

function mymodule_form(&$form_state){
  // Form fields go here....
  // Then...
  $form['#token'] = false;
  // You have to call it in after_build
  $form['#after_build'] = array('_unset_form_elements');
  return $form;
}

function _unset_form_elements($form){
  unset($form['#build_id'], $form['form_build_id'], $form['form_id']);
  return $form;
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.