How to remove form_build_id, form_id, op parameters that are added to a URL after submitting a form using GET method in Drupal 8?

2 Answers 2


FormState::cleanValues does exactly that:

Removes internal Form API elements and buttons from submitted form values.

This function can be used when a module wants to store all submitted form values, for example, by serializing them into a single database column. In such cases, all internal Form API values and all form button elements should not be contained, and this function allows their removal before the module proceeds to storage. Next to button elements, the following internal values are removed by default.

  • form_id
  • form_token
  • form_build_id
  • op

But as you're not POSTing the form you can't really use it. Two options spring to mind:

  1. Implement your own cleaning method. This might be tricky as you don't have the form fields to work with so unless you have a list of known good fields available, there's always the possibility you'll include something you don't mean to
  2. Change your form's flow to Post/Redirect/Get (PRG). The steps are roughly:

    • Change the form method to POST
    • In the submit handler:
      • Use FormState::cleanValues to clean the input
      • Build a new Url with the desired redirect path, and query options made up of the clean form state values
      • Use $form_state->setRedirect($url); to redirect the user to the new URL

    From the user's point of view, nothing really changes. They still end up at the same URL, just without the undesired query args.

  • But how can I use this function with a GET form? Submit function doesn't work in this case. Also, the form has an ajax element using Drupal from api. Is it possible to use cleanValues in this case or do I have to find some custom way?
    – Andrew Nim
    Apr 12, 2018 at 18:55
  • You're absolutely right, sorry. 2 mins, I'll update the answer with some ideas
    – Clive
    Apr 12, 2018 at 19:23
  • I used $form_state->setRedirect($url) and it is working as needed. Thank you for the answer.
    – Andrew Nim
    Apr 13, 2018 at 13:27

If you want to avoid a redirect after POST, you can keep the form method as GET and add these two tweaks:

In your form definition:

$form['#method'] = 'get';
$form['#action'] = Url::fromRoute($destination_route)
$form['submit'] = [
  '#type' => 'submit',
  '#value' => 'Whatever',
  // Prevent op from showing up in the query string.
  '#name' => '',

In your .module file:

 * Implements hook_form_ID_alter().
function your_module_form_your_form_alter(&$form, FormStateInterface $form_state) {
  // Hide these fields from the query string.
  $form['form_id']['#access'] = FALSE;
  $form['form_build_id']['#access'] = FALSE;

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.