Secure Dynamic Forms and Subforms

This article is a follow up to my first tutorial on the subject: A Dynamically Expanding AJAX/AHAH Drupal Form Element. The basic flow of that article is still correct, but two month ago I could not figure out how to do dynamic forms without grabbing what I needed out of $_POST, which removes all the great FAPI security. Now I have figured it out and present the dynamic_subform module in Ahah Forms v1.5, which provides functions for securely creating and updating dynamic forms and subforms.

Ahah Forms Demo Site

Update: The demo site is currently resting. It might return in the future.

You can try out demos of the examples in the Ahah Forms package (Dynamic Polls, Views and Todo Lists) over at: http://demo.starbowconsulting.com.

Ahah Session Slides

Wow, the Summit was quite something. My head is still spinning from all the new info. I think my session went really well. Got some good questions, and feedback. Still need to figure out how to do the dynamic forms thing without opening up a security hole. More on that soon. Until then here are my slides:

Ahah_forms reloaded

Let's start with a review for those who have not already drunk the ahah forms framework kool-aid: Ahah forms is a utility for attaching Ajax-style partial page loading to Drupal forms without having to code any javascript. This is similar to Ruby on Rails' link_to_remote tag or form_remote_tag() function. The method I use to declare the binding is a custom extension to the formAPI.

Syndicate content