Zend form：编辑时存储条目ID的安全方式？
我是 Zend Framework 的新手，在使用 Zend_Form 创建编辑表单时遇到问题。
我的问题是我需要在编辑过程中存储条目 ID，我见过一些使用隐藏表单字段的示例，但隐藏字段可以由用户操作。
那么：如何设置一个由 $form->populate($data); 填充的表单字段，并且在提交请求后可用，但用户无法以任何方式编辑/可见？
感谢您的帮助！
I'm new to the Zend Framework and I have a problem to create an edit form with the Zend_Form.
My problem is that I need to store the entry ID during editing, I've seen some examples that are using a hidden form field, but a hidden field can be manipulated by a user.
So: how can I set a form field which gets populated by $form->populate($data); and is available after submiting the request but is not editabel/visible to the user in any way?
Thanks for any help!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
我不确定试图隐藏该值是否真的有意义。
请考虑以下事项：
因此，如果您将 ID 放入表单中，那么实际上并不重要：
I'm not sure if there's really a point in trying to hide the value.
Consider the following:
Thus, if you put the ID in the form, it shouldn't really matter:
你想隐藏什么样的数据？
数据应该在 post 或 get 中。如果您不将数据放入表单中，那么您将不得不使用 GET，它的安全性不如 POST。
如果您有一些数据并且不希望用户看到这些数据，那么您不应该将这些数据放入表单中。您可以使用表单
提交的值存储和检索隐藏数据。假设您的隐藏字段是用户的密码。当客户端编辑表单时，您不需要将密码发送回客户端。您可以根据用户提交的名字和姓氏在控制器中操作密码。如果您仍然坚持，您可能想尝试使用 ZF 加密数据并回显您的值并将加密数据设置到隐藏的表单元素中。
what kind of data you wanna hide?
data should be in post or get.if you dont put your data in your form,then you will have to use GET which is less secure than POST.
If you have some data and you dont want the user to see those data,then you should not put those data in a form.you can store and retrieve hidden data using form
s submitted values.lets suppose your hidden field is users password.you dont need to send password back to the client when client is editing the form.you can manipulate password in your controller according to the user`s submitted first name and last name.If you still insist, you may wanna try encrypting data using ZF and echo ing your value and setting encrypted data into a hidden form element.
Zend_Form 使用您指定的表单元素生成一个 HTML 表单元素。因此它的元素功能被缩小为简单的 HTML 形式。
隐藏的表单元素用于传递用户不应该手动输入的数据。但正如您自己所说，不能保证它不会被篡改。因此使用隐藏的表单值并不能提供安全性。
大多数时候，您最好使用服务器端值（例如存储在会话中）来引用要防止用户访问的值。
我建议您将 ID 保留在会话值中，然后您可以在隐藏表单字段中使用会话密钥。这样用户就无法更改目标ID。但是，您无法一步使用 $form->populate($values) 。您必须通过其他步骤设置目标值：
Zend_Form generates an HTML form element with the form elements you specify. So its element capabilities are narrowed to a simple HTML form.
The hidden form element is used to pass those data that the user is not supposed to enter by hand. But as you yourself said it, there is no guaranty it could not be tampered. so no security is provided by using a hidden form value.
Most of times you'd better use server side values (like stored in sessions) to reference to values that are to be protected from user.
I suggest you keep the ID in a session value, and then you could use the session key in the hidden form field. this way the user can not change the target ID. However you are not able to use the $form->populate($values) on this in one step. you would have to set the target value with other steps: