Drupal 7 Module Development

Chapter 8
This approach is the proper way to remove form elements from Drupal. You may
find yourself tempted to unset() certain form elements, but since Drupal forms are
passed by reference through a series of drupal_alter() hooks, the unset() cannot
be considered reliable. Using unset() also removes valuable context that other
modules may be relying on when processing the $form.
Passing secure data via forms
As a general rule, Drupal forms do not use the traditional hidden form element
of HTML. Since hidden form elements are rendered in the browser, curious users
(and malicious ones) can view the elements of a form, checking for tokens and other
security devices.
Since Drupal is a PHP application, it can use server-side processes to handle secret
form elements, rather than relying on information passed as hidden fields from
the browser.
To pass such data, a form element may be defined as '#type' => 'value'. Using
this Forms API element prevents the data from being rendered to the browser. As
an additional advantage, it also allows for the passing of complex data—such as an
array—during a form request. This technique is commonly used for form elements
that the user should never see such as the id of an element to be deleted during a
confirmation step. Consider the following code from aggregator.module:
function aggregator_admin_remove_feed($form, $form_state, $feed) {
return confirm_form(
array(
'feed' => array(
'#type' => 'value',
'#value' => $feed,
),
),
t('Are you sure you want to remove all items from the feed
%feed?', array('%feed' => $feed->title)),
'admin/config/services/aggregator',
t('This action cannot be undone.'),
t('Remove items'),
t('Cancel')
);
}
[ 231 ]