0

I have a field with multiple values and i want to make form element more intuitive to work with.

I thought the easiest way would be to create custom html and include it in form, with the other elements. Is this ok?

Now the problem is, on form submit i can't access any of these values in this fields that are not native form elements. Is there a way to convince drupal to take in into $form_state['values'];

I know the right way is to create custom form element but i am afraid it would took me too much time.

4
  • 1
    If you know what the right way is, why don't you do it?
    – Turion
    Commented Aug 30, 2013 at 9:35
  • You think using specialised API would took more time than reinventing it? Sounds strange to me.
    – Mołot
    Commented Aug 30, 2013 at 9:41
  • I am just asking if there is a faster way. I have never created new form element. No need for being smart Molot.
    – gregab
    Commented Aug 30, 2013 at 9:43
  • I wouldn't take that as snarky from @Mołot, I'm pretty positive he meant that in a friendly way
    – Clive
    Commented Aug 30, 2013 at 11:15

1 Answer 1

1

Is there a way to convince drupal to take in into $form_state['values']

Yes...use the Form API :)

To expand; Drupal builds and caches the fields for a form on the server side, and uses that cache upon submission to make sure the form hasn't been altered. Drupal, rightly, sees the injection of arbitrary HTML into the structured form as an attack vector, a security hole which must be plugged up.

Consider what would happen if this weren't the case - a client using your form could inject some HTML form values, overriding your particular intentions for the form submission. As Drupal cannot possibly reconcile the context in which that HTML string was added, it has no way to know if it's come from a trustworthy source.

Bottom line - if you want to add a field to a form that's managed by the form API, your code absolutely needs to conform to the same API - the alternative is to fight against it, which is never fun.

It's physically possible to get around the validation, but the amount of time it would take to convince Drupal to accept your injected form values, and at the same time keep it secure, would far outweigh how long it would take to use the form API as it was intended.

1
  • Thanks:) It makes sense. I knew i had to go with Form API, but it is really long way to create custom element for multiple value field. I was hoping i wouldn't need to.
    – gregab
    Commented Aug 30, 2013 at 11:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.