Where is the best place in Joomla MVC (server-side) to forbid users from changing a value in a pre-existing form record? In JTable check / bind/ JModel prepareTable, or elsewhere?

For context, I have a form in my component with certain fields that shouldn't change after initial creation - though other fields are editable.

I can disable or simply not render the fields in the edit view of the item if it has an ID, but that won't stop a well-crafted POST, so I'd like to simply 'ignore' a series of values if the data array has an ID > 0 (and thus exists).

1 Answer 1


JTable method check is design for

Method to perform sanity checks on the JTable instance properties to ensure they are safe to store in the database.

JTable method bind is design for

Method to bind an associative array or object to the JTable instance.

So both of them are not designed for what you are trying to do.

However JModel method prepareTable is designed for

Prepare and sanitise the table data prior to saving.

So it's exactly what you need.

protected function prepareTable($table)
  // Row exists?
  if ((int)$table->id > 0) {
    // Ignore certain fields
  • Thanks for taking the time to answer - I had a feeling it was prepareTable', but had a look at bind` and saw we have that ignore parameter which won't bind certain values before save. Wondering if that's 'cleaner', as I'm already overriding bind for something else. Aug 10, 2016 at 13:03
  • 1
    Yes, it is actually an option. And since your are already overriding bind, you can use that. You can pass array of fieldnames or string with space separated field names to ignore. It would work same way and would be cleaner in your situation.
    – Rene Korss
    Aug 10, 2016 at 13:06
  • Thanks for the input - will leave this open for a day or 2 to see if anyone else has any thoughts, then mark as answered :) Aug 10, 2016 at 13:10
  • Just working this up now - I've since found prepareTable works better here - bind is called on load AND save, which means any ignored fields won't appear in the edit layout (even as readonly) because they're never bound. Unset in prepareTable works great though! Aug 11, 2016 at 17:06
  • Yeah. You are absolutely right. Then only prepareTable will be valid solution.
    – Rene Korss
    Aug 11, 2016 at 17:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.