title: Cakephp 2 security in forms
body: <p>I have a question about the cakephp2 forms security. Let's assume that we have the Security Component enabled and have already build users authentication, permissions, and product management system.</p>
  
  <p>We need to create an Offer Request feature, which allows users to ask for an offer for a specific product.</p>
  
  <p>The user is logged in and clicks on "ask" and goes to /offer_requests/add/product_id</p>
  
  <hr>
  
  <p><strong>Scenario 1:</strong></p>
  
  <p>In the /Views/OfferRequests/add.ctp:</p>
  
  <pre><code>&lt;?php 
  echo $this-&gt;Form-&gt;create('OfferRequest');
  echo $this-&gt;Form-&gt;input('user_id', 
                           array('value' =&gt; $this-&gt;Session-&gt;read('Auth.User.id'),
                                 'type' =&gt; 'hidden' ));
  echo $this-&gt;Form-&gt;input('product_id');
  echo $this-&gt;Form-&gt;input('quantity');
  echo $this-&gt;Form-&gt;end(__('Submit'));
  ?&gt;
  </code></pre>
  
  <p><strong>Scenario 2:</strong></p>
  
  <p>In the /Views/OfferRequests/add.ctp:</p>
  
  <pre><code>&lt;?php 
  echo $this-&gt;Form-&gt;create('OfferRequest');
  echo $this-&gt;Form-&gt;input('product_id');
  echo $this-&gt;Form-&gt;input('quantity');
  echo $this-&gt;Form-&gt;end(__('Submit'));
  ?&gt;
  </code></pre>
  
  <p>And in the OfferRequestsController add():</p>
  
  <pre><code>&lt;?php
  $this-&gt;request-&gt;data['OfferRequest']['user_id'] = $this-&gt;Session-&gt;read('Auth.User.id');
  ?&gt;
  </code></pre>
  
  <p>My question is which scenario is more safe, for example against making false requests as other user. For scenario 1, does the Security Component allow manipulating input values through Firebug or some other software?</p>