Take the 2-minute tour ×

I have a simple form with a couple select inputs. One of which is a gender selections.

The input is generated like so:

echo $this->Form->input('gender_id', array(
    'options' => array(
        1 => 'Male',
        2 => 'Female'

How can I ensure that only the given selects can be submit, so that a 3 or something can not be submitted?

I am using the Security component and it seems to protect against field name tampering but not value tampering.

Doing a simple comparison would not be practical for larger select lists like a State select. Also I'm trying to avoid doing extra queries to validate ids.

share|improve this question
There is a recent discussion on this topic here: cakephp.lighthouseapp.com/projects/42648/tickets/… –  nIcO Jun 12 '12 at 7:18
Thanks for the link. Sounds like it's not implemented and will not be added in the future either. –  Paramount Jun 12 '12 at 20:17

2 Answers 2

up vote 1 down vote accepted

Require values to be in a specified list for your Model's validation:

public $validate = array(
    'gender_id' => array(
      'allowed' => array(
      'rule'    => array('inList', array(1, 2)),
      'message' => 'Please select male or female.'
share|improve this answer

Make this field in the DB an ENUM field with allowed value 1 and 2.

You can not prevent that somebody will submit a third value, simply by manipulating the DOM or the POST request with FireBug. If it is not a DB value and does not run trough the Model form validation rules you have to do it manually in your controller. Since only there this kind of validation is necessary according to your description.

share|improve this answer
I suppose that's doable for a gender field but I don't believe that's as practical for a state field. For that I am using an associated table. –  Paramount Jun 12 '12 at 1:19
Then add a foreign key (you should really have these already, Cake is built around them). The DB violation will trigger a cakeError. –  Jay Jun 12 '12 at 1:22
@powtac thanks for the edit. I am not suggesting that a user will not be able to manipulating the DOM. I was more of wondering if Cake cached the select values that could then later be compared to. I am quite surprised that the Security component does not automatically do this for you considering the extent it goes through to valid field names. –  Paramount Jun 12 '12 at 1:30
Doesn't it (the sec component) do this? The last time I used it, it added a extra token and when I tried to manipulate the DOM, the sec component prevented it. (But maybe I tried to overcome Model validation) –  powtac Jun 12 '12 at 1:33
It may, and I may be not be implementing it correctly. Unfortunately this part of Cake's book is lacking. see book.cakephp.org/2.0/en/core-libraries/components/… –  Paramount Jun 12 '12 at 1:37

Your Answer


