I have form which is submitted via GET method. The problem is that after submit the URL looks very bad, with lots of parameters like form_build_id & form_token. How can I get rid of them? Thanks
-
Why you do not use POST method ? I think some parameters like form_build_id and form_token should not be removed.– SithuAug 3, 2012 at 6:31
-
I have no validation & no submit functions. I just needed to add some parameters to the url, that's it– Marius IlieAug 3, 2012 at 9:11
-
Related: drupal.org/node/821932– roobyOct 12, 2016 at 21:18
4 Answers
I ended up doing this:
$form = drupal_get_form('my_form_id');
unset($form['form_build_id']);
unset($form['form_id']);
unset($form['form_token']);
-
1I'd be very careful about doing this. The docs have a comment that all three of those values are needed for form processing and validation. The last value is used to protect against CSRF so is a potential security risk (depending on what the link does). The form cache won't work without form_build_id, and I don't know what other problems might occur!– AndyAug 3, 2012 at 8:09
-
I don't think they matter for forms submitted via GET. Anyway, I have no validation or submit functions, I just needed to add some params to the url, that's it Aug 3, 2012 at 8:47
-
1
-
1But presumably at some point something's using those params yeah? The question is what are they used for?– AndyAug 3, 2012 at 10:07
-
1A little late but an example of where this may be needed is when creating a custom form that is used as a 'search block'. This search block uses the 'get' method and sends the request to view. No updates or creation.– AmarjitApr 13, 2016 at 12:28
These values shouldn't be needed for GET forms, but might be. Using POST instead is not a suitable fix, that has other side effects.
According to the specs:
- GET should be used to change the content of the page displayed
- POST should be used to pass data or instructions to the server
A POST request should therefore be treated with care, as you might use it for something like adding an answer to a question. You don't want to accidentally send that answer twice, or it will show on the site twice - that's why browsers will warn you when you reload a page that you sent POSTDATA to. You also don't want another site to pretend to be you and answer a question on your behalf (that's called XSRF or cross-site request forgery).
These variables are included to protect against these dangers of POST, but they are not necessary if you are doing a (read-only) GET request. Other advantages of using GET at that the response can be cached, bookmarked and indexed by search engines.
A final warning: although you're not meant to change anything as the result of a GET request, there's nothing stopping you from doing so. That's probably why Drupal includes this protection.
Following what views does with the views_exposed_form you can easily do this to hide form_build_id form_token and form_id. Considering views is one of the top contrib modules I would say this is pretty safe:
/**
* Implement hook_form_alter for the exposed form.
*
* Since the exposed form is a GET form, we don't want it to send a wide
* variety of information.
*/
function MYMODULE_form_MY_FORM_ID_alter(&$form, &$form_state) {
$form['form_build_id']['#access'] = FALSE;
$form['form_token']['#access'] = FALSE;
$form['form_id']['#access'] = FALSE;
}
See views.module and views_exposed_form() and views_form_views_exposed_form_alter()
Following worked for me...
function mymodule_form(&$form_state){
// Form fields go here....
// Then...
$form['#token'] = false;
// You have to call it in after_build
$form['#after_build'] = array('_unset_form_elements');
return $form;
}
function _unset_form_elements($form){
unset($form['#build_id'], $form['form_build_id'], $form['form_id']);
return $form;
}