Gravity Forms
+ Trusted Values

Everything a form puts on the page can be read and changed in the browser: Hidden fields, a price list code, an internal e-mail address for routing, the rate inside a calculation, the account e-mail you filled in for a signed-in customer. Most visitors never look. The one who does can send a quote request with a lower rate, another customer's account address or a different price list, and the entry looks just like the others.

The Gravity Forms Trusted Values Premium Add-on lets a field get its value from your server instead. A server-only field is left out of the page and filled in when the form is sent: from the signed-in user, user meta, the page the form is on, a page custom field, fixed text, the date or a hidden formula whose formula never reaches the browser. Hidden fields can be locked to their default value. Whatever the browser sends for these fields is replaced, and when it sent something else you see it on the entry.

When the form is shown, server-only fields are left out of the page, and a short signed value records which page the form is on. When the form is sent, before Gravity Forms validates anything, the add-on works out each trusted value on your server: it reads the signed-in user, the signed page, the fixed text or the date, works out hidden formulas from the answers in the submission, and recomputes the default value of locked Hidden fields. These values replace whatever the browser sent, so validation, conditional logic, notifications and feeds all see the trusted values. If the browser sent something different, the entry gets a note, a "Changed in browser" mark and a box with what was sent, the notification event can alert you, and the form can mark the entry as spam.