# How hidden field

**URL:** <https://www.ruby-forum.com/t/how-hidden-field/167269>\
**Category:** Rails\
**Created:** [May 6, 2009, 9:17am UTC](https://www.ruby-forum.com/t/how-hidden-field/167269 "2009-05-06T09:17:12Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ple\_mazako](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/5daacb/32.png) [@ple\_mazako](https://www.ruby-forum.com/u/ple_mazako)\
**Post date:** [May 6, 2009, 9:17am UTC](https://www.ruby-forum.com/t/how-hidden-field/167269/1 "2009-05-06T09:17:12Z")

</div>

Dear all,

i wrote script in view like this,  
\<% form\_for :seq do |form| %\>  
  
Source Information

  
User ID   
\<%= form.text\_field :user\_id, :value =\> session  
[:user\_id],:size=\>10 %\>  

 \<% end %\>

and i want hide this field to user but i want value= session[:user\_id]  
to insert database automatically  
how i do?  
thank you

---

<div class="post-metadata">

**Author:** ![ple\_mazako](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/5daacb/32.png) [@ple\_mazako](https://www.ruby-forum.com/u/ple_mazako)\
**Post date:** [May 6, 2009, 1:28pm UTC](https://www.ruby-forum.com/t/how-hidden-field/167269/2 "2009-05-06T13:28:15Z")

</div>

Change form.text\_field for form.hidden\_field, see

> **[ActionView::Helpers::FormHelper](https://api.rubyonrails.org/classes/ActionView/Helpers/FormHelper.html)**
>
> Form helpers are designed to make working with resources much easier compared to using vanilla HTML.

for more options.

Regards.

Franco C…

---

<div class="post-metadata">

**Author:** ![ple\_mazako](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/5daacb/32.png) [@ple\_mazako](https://www.ruby-forum.com/u/ple_mazako)\
**Post date:** [May 6, 2009, 5:33pm UTC](https://www.ruby-forum.com/t/how-hidden-field/167269/3 "2009-05-06T17:33:36Z")

</div>

Just make sure you don’t create a security hole where a “bad user”  
could change the hidden user\_id to create problems for the  
application.

---

<div class="post-metadata">

**Author:** ![ple\_mazako](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/5daacb/32.png) [@ple\_mazako](https://www.ruby-forum.com/u/ple_mazako)\
**Post date:** [May 9, 2009, 7:44pm UTC](https://www.ruby-forum.com/t/how-hidden-field/167269/4 "2009-05-09T19:44:03Z")

</div>

Just as long as you know that users can EASILY change values you put  
into hidden fields… so If they can mess up the system, somebody  
will.

If you need to protect against that (and don’t want to store this  
stuff in the session which is where I’d put it) then ALSO include a  
hash of the hidden value + a secret value to protect against changes.

Brendon.

---

<div class="post-metadata">

**Author:** ![ple\_mazako](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/5daacb/32.png) [@ple\_mazako](https://www.ruby-forum.com/u/ple_mazako)\
**Post date:** [May 7, 2009, 6:37am UTC](https://www.ruby-forum.com/t/how-hidden-field/167269/5 "2009-05-07T06:37:14Z")

</div>

thank you so much  
i use form.hidden\_field .it’s work  
-\_-

2009/5/6 Brendon [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)