Submitting disabled fields on content entry forms? I need to submit content entry forms that have default values set in disabled elements.  However, if I remember correctly, HTTP specifies that fields that are disabled do not have their values sent to the web server (or are dropped by the web server, I can't remember).

Specifically, I have a tag field (term reference) that is a select list, and it defaults to a particular value that is updated twice a year and it cannot be changed by users submitting the form.  I want this field to appear to the user, but at the same time I want it disabled so they can't change it.

How can I submit a disabled field in Drupal 7?
As long as security is not a concern, the following can be done:


Use hook_form_alter to create an additional hidden field in the form.
The name attribute of this hidden field should be equivalent to the name of the disabled field.  The value attribute of the hidden field should be equivalent to the currently selected value.
The hidden field needs to be placed at the very END of the HTML form, or at the very lease, immediately after the disabled field.  The reason for this is that, according to the HTTP specification, if you submit multiple fields with the same name, the last field in the flow of the HTML has it's value submitted above all other submissions.  Of course, disabled fields have their values dropped altogether, so the hidden field could technically appear anywhere in the form, but this would be "best practice".


Here's some code from my hook_form_alter:

function ccom_validations_form_challenges_node_form_alter(&amp;$form, &amp;$form_state, $form_id) {
  $form['my_field'] = array (
    '#type' =&gt; 'hidden',
    '#value' =&gt; 'schweet'
  );
  $defaultValue = $form['field_reporting_period']['und']['#default_value'][0];
  $form['my_field']['#attributes']['name'] = 'field_reporting_period[und]';
  $form['my_field']['#attributes']['value'] = $defaultValue;
  $form['my_field']['#weight'] = '4';
  $form['field_reporting_period']['#disabled'] = 'true';
  dpm($form);
}


So in the above code you can see how I've assigned the name and value to the field, adjusted the weight so it appears last in the list (using DPM I found that the the highest weight value was 3 in the form, so I used 4 so it was weighted the heaviest), and finally indicated that the original field I wanted disabled is in fact disabled.  Note that you disable form fields in Drupal using the meta attribute #disabled, rather than specifying the disabled attribute directly in the #attributes array.  Weird.

Now this obviously isn't secure, because anybody with any browser HTML manipulation tool like the Chrome Inspector can enable the field and move it to last in the list and then it's value would be used rather than the hidden fields.  I'll revisit this later if security really becomes a concern in this area.