Form Controls
Overview of built-in form controls.
addText(string|int $name, $label=null, $cols, ?int $maxLength=null): TextInput
Adds single line text field (class TextInput). If the user does not fill in the field,
it returns an empty string ''
, or use setNullable()
to change it to return null
.
$form->addText('name', 'Name:')
->setRequired()
->setNullable();
It automatically validates UTF-8, trims left and right whitespaces, and removes line breaks that could be sent by an attacker.
The maximum length can be limited using setMaxLength()
. The addFilter() allows you to change the user-entered value.
You can change the visual character of a text field to types like search
, tel
, or url
using setHtmlType()
, as seen in the specification. Remember that changing the type
is only visual and does not perform validation functions. For the url
type, it is appropriate to add a specific URL rule.
For other input types such as number
, range
, email
, date
,
datetime-local
, time
, and color
, use specialized methods like addInteger, addFloat, addEmail addDate, addTime, addDateTime, and addColor, which ensure server-side validation. The types month
and week
are not
yet fully supported in all browsers.
The so-called empty-value can be set for the element, which is something like the default value, but if the user does not
overwrite it, returns empty string or null
.
$form->addText('phone', 'Phone:')
->setHtmlType('tel')
->setEmptyValue('+420');
addTextArea(string|int $name, $label=null): TextArea
Adds a multiline text field (class TextArea).
If the user does not fill in the field, it returns an empty string ''
, or use setNullable()
to change it
to return null
.
$form->addTextArea('note', 'Note:')
->addRule($form::MaxLength, 'Your note is way too long', 10000);
Automatically validates UTF-8 and normalizes line breaks to \n
. Unlike a single-line input field, it does not
trim the whitespace.
The maximum length can be limited using setMaxLength()
. The addFilter() allows you to change the user-entered value. You can set the
so-called empty-value using setEmptyValue()
.
addInteger(string|int $name, $label=null): TextInput
Adds input field for integer (class TextInput). Returns either an integer or
null
if the user does not enter anything.
$form->addInteger('year', 'Year:')
->addRule($form::Range, 'The year must be in the range %d to %d.', [1900, 2023]);
The element is rendered as <input type="numeric">
. By using the setHtmlType()
method, you can
change the type to range
for display as a slider, or to text
if you prefer a standard text field without
the special behavior of numeric
.
addFloat(string|int $name, $label=null): TextInput
Adds a field for entering a decimal number (TextInput class). Returns either float or
null
, if the user does not specify anything.
$form->addFloat('level', 'Level:')
->setDefaultValue(0)
->addRule($form::Range, 'The level must be in the range %d to %d.', [0, 100]);
The element is rendered as <input type="numeric">
. By using the setHtmlType()
method, you can
change the type to range
for display as a slider, or to text
if you prefer a standard text field without
the special behavior of numeric
.
Nette and the Chrome browser accept both a comma and a dot as decimal separators. To make this functionality available in
Firefox, it is recommended to set the lang
attribute either for the specific element or for the entire page, for
example, <html lang="cs">
.
addEmail(string|int $name, $label=null, int $maxLength=255): TextInput
Adds email address field with validity check (class TextInput). If the user does not fill in the field,
it returns an empty string ''
, or use setNullable()
to change it to return null
.
$form->addEmail('email', 'Email:');
Verifies that the value is a valid email address. It does not verify that the domain actually exists, only the syntax is verified. Automatically validates UTF-8, trims left and right whitespaces.
The maximum length can be limited using setMaxLength()
. The addFilter() allows you to change the user-entered value. You can set the
so-called empty-value using setEmptyValue()
.
addPassword(string|int $name, $label=null, $cols, ?int $maxLength=null): TextInput
Adds password field (class TextInput).
$form->addPassword('password', 'Password:')
->setRequired()
->addRule($form::MinLength, 'Password has to be at least %d characters long', 8)
->addRule($form::Pattern, 'Password must contain a number', '.*[0-9].*');
When you re-send the form, the input will be blank. It automatically validates UTF-8, trims left and right whitespaces, and removes line breaks that could be sent by an attacker.
addCheckbox(string|int $name, $caption=null): Checkbox
Adds a checkbox (class Checkbox). The field
returns either true
or false
, depending on whether it is checked.
$form->addCheckbox('agree', 'I agree with terms')
->setRequired('You must agree with our terms');
addCheckboxList(string|int $name, $label=null, ?array $items=null): CheckboxList
Adds list of checkboxes for selecting multiple items (class CheckboxList). Returns the array of keys of the
selected items. The getSelectedItems()
method returns values instead of keys.
$form->addCheckboxList('colors', 'Colors:', [
'r' => 'red',
'g' => 'green',
'b' => 'blue',
]);
We pass the array of items as the third parameter, or by the setItems()
method.
You can use setDisabled(['r', 'g'])
to disable individual items.
The element automatically checks that there has been no forgery and that the selected items are actually one of the offered
ones and have not been disabled. The getRawValue()
method can be used to retrieve submitted items without this
important check.
When default values are set, it also checks that they are one of the offered items, otherwise it throws an exception. This
check can be turned off with checkDefaultValue(false)
.
If you are submitting a form using the GET
method, you can choose a more compact data transfer method that saves
on the size of the query string. This is activated by setting the HTML attribute of the form:
$form->setHtmlAttribute('data-nette-compact');
addRadioList(string|int $name, $label=null, ?array $items=null): RadioList
Adds radio buttons (class RadioList). Returns
the key of the selected item, or null
if the user did not select anything. The getSelectedItem()
method
returns a value instead of a key.
$sex = [
'm' => 'male',
'f' => 'female',
];
$form->addRadioList('gender', 'Gender:', $sex);
We pass the array of items as the third parameter, or by the setItems()
method.
You can use setDisabled(['m'])
to disable individual items.
The element automatically checks that there has been no forgery and that the selected item is actually one of the offered ones
and has not been disabled. The getRawValue()
method can be used to retrieve the submitted item without this
important check.
When default value is set, it also checks that it is one of the offered items, otherwise it throws an exception. This check can
be turned off with checkDefaultValue(false)
.
addSelect(string|int $name, $label=null, ?array $items=null, ?int $size=null): SelectBox
Adds select box (class SelectBox). Returns
the key of the selected item, or null
if the user did not select anything. The getSelectedItem()
method
returns a value instead of a key.
$countries = [
'CZ' => 'Czech republic',
'SK' => 'Slovakia',
'GB' => 'United Kingdom',
];
$form->addSelect('country', 'Country:', $countries)
->setDefaultValue('SK');
We pass the array of items as the third parameter, or by the setItems()
method. The array of items can also be
two-dimensional:
$countries = [
'Europe' => [
'CZ' => 'Czech republic',
'SK' => 'Slovakia',
'GB' => 'United Kingdom',
],
'CA' => 'Canada',
'US' => 'USA',
'?' => 'other',
];
For select boxes, the first item often has a special meaning, it serves as a call-to-action. Use the setPrompt()
method to add such an entry.
$form->addSelect('country', 'Country:', $countries)
->setPrompt('Pick a country');
You can use setDisabled(['CZ', 'SK'])
to disable individual items.
The element automatically checks that there has been no forgery and that the selected item is actually one of the offered ones
and has not been disabled. The getRawValue()
method can be used to retrieve the submitted item without this
important check.
When default value is set, it also checks that it is one of the offered items, otherwise it throws an exception. This check can
be turned off with checkDefaultValue(false)
.
addMultiSelect(string|int $name, $label=null, ?array $items=null, ?int $size=null): MultiSelectBox
Adds multichoice select box (class MultiSelectBox). Returns the array of keys of
the selected items. The getSelectedItems()
method returns values instead of keys.
$form->addMultiSelect('countries', 'Countries:', $countries);
We pass the array of items as the third parameter, or by the setItems()
method. The array of items can also be
two-dimensional.
You can use setDisabled(['CZ', 'SK'])
to disable individual items.
The element automatically checks that there has been no forgery and that the selected items are actually one of the offered
ones and have not been disabled. The getRawValue()
method can be used to retrieve submitted items without this
important check.
When default values are set, it also checks that they are one of the offered items, otherwise it throws an exception. This
check can be turned off with checkDefaultValue(false)
.
addUpload(string|int $name, $label=null): UploadControl
Adds file upload field (class UploadControl). Returns the FileUpload object, even if the user has not uploaded a file, which can be find out by the
FileUpload::hasFile()
method.
$form->addUpload('avatar', 'Avatar:')
->addRule($form::Image, 'Avatar must be JPEG, PNG, GIF, WebP or AVIF')
->addRule($form::MaxFileSize, 'Maximum size is 1 MB', 1024 * 1024);
If the file did not upload correctly, the form was not submitted successfully and an error is displayed. I.e. it is not
necessary to check the FileUpload::isOk()
method.
Do not trust the original file name returned by method FileUpload::getName()
, a client could send a malicious
filename with the intention to corrupt or hack your application.
Rules MimeType
and Image
detect required type of file or image by its signature. The integrity of the
entire file is not checked. You can find out if an image is not corrupted for example by trying to load it.
addMultiUpload(string|int $name, $label=null): UploadControl
Adds multiple file upload field (class UploadControl). Returns an array of objects FileUpload. The FileUpload::hasFile()
method will return true
for
each of them.
$form->addMultiUpload('files', 'Files:')
->addRule($form::MaxLength, 'A maximum of %d files can be uploaded', 10);
If one of the files fails to upload correctly, the form was not submitted successfully and an error is displayed. I.e. it is
not necessary to check the FileUpload::isOk()
method.
Do not trust the original file names returned by method FileUpload::getName()
, a client could send a malicious
filename with the intention to corrupt or hack your application.
Rules MimeType
and Image
detect required type of file or image by its signature. The integrity of the
entire file is not checked. You can find out if an image is not corrupted for example by trying to load it.
addDate(string|int $name, $label=null): DateTimeControl
Adds a field that allows the user to easily input a date consisting of year, month, and day (class DateTimeControl).
For the default value, it accepts either objects implementing the DateTimeInterface
, a string with time, or a
number representing a UNIX timestamp. The same applies to the Min
, Max
, or Range
rule
arguments, which define the minimum and maximum allowed date.
$form->addDate('date', 'Date:')
->setDefaultValue(new DateTime)
->addRule($form::Min, 'The date must be at least a month old.', new DateTime('-1 month'));
By default, it returns a DateTimeImmutable
object. Using the setFormat()
method, you can specify a text format or timestamp:
$form->addDate('date', 'Date:')
->setFormat('Y-m-d');
addTime(string|int $name, $label=null, bool $withSeconds=false): DateTimeControl
Adds a field that allows the user to easily input time consisting of hours, minutes, and optionally seconds (class DateTimeControl).
For the default value, it accepts either objects implementing the DateTimeInterface
, a string with time, or a
number representing a UNIX timestamp. Only the time information from these inputs is used; the date is ignored. The same applies
to the Min
, Max
, or Range
rule arguments, which define the minimum and maximum allowed
time. If the minimum value set is higher than the maximum, a time range spanning midnight is created.
$form->addTime('time', 'Time:', withSeconds: true)
->addRule($form::Range, 'Time must be between %d and %d.', ['12:30', '13:30']);
By default, it returns a DateTimeImmutable
object (with date of January 1, year 1). Using the
setFormat()
method, you can specify a text format:
$form->addTime('time', 'Time:')
->setFormat('H:i');
addDateTime(string|int $name, $label=null, bool $withSeconds=false): DateTimeControl
Adds a field that allows the user to easily input both date and time consisting of year, month, day, hours, minutes, and optionally seconds (class DateTimeControl).
For the default value, it accepts either objects implementing the DateTimeInterface
, a string with time, or a
number representing a UNIX timestamp. The same applies to the Min
, Max
, or Range
rule
arguments, which define the minimum and maximum allowed date.
$form->addDateTime('datetime', 'Date and Time:')
->setDefaultValue(new DateTime)
->addRule($form::Min, 'The date must be at least a month old.', new DateTime('-1 month'));
By default, it returns a DateTimeImmutable
object. Using the setFormat()
method, you can specify a text format or timestamp:
$form->addDateTime('datetime')
->setFormat(DateTimeControl::FormatTimestamp);
addColor(string|int $name, $label=null): ColorPicker
Adds a color selection field (class ColorPicker). The color is a string in the format
#rrggbb
. If the user doesn't make a selection, the default color returned is black #000000
.
$form->addColor('color', 'Color:')
->setDefaultValue('#3C8ED7');
addHidden(string|int $name, ?string $default=null): HiddenField
Adds hidden field (class HiddenField).
$form->addHidden('userid');
Use setNullable()
to change it to return null
instead of an empty string. The addFilter() allows you to change the submitted value.
Although the element is hidden, it is important to realize that its value can still be modified or spoofed by an attacker. Always thoroughly verify and validate all received values on the server side to prevent security risks associated with data manipulation.
addSubmit(string|int $name, $caption=null): SubmitButton
Adds submit button (class SubmitButton).
$form->addSubmit('submit', 'Register');
It is possible to have more than one submit button in the form:
$form->addSubmit('register', 'Register');
$form->addSubmit('cancel', 'Cancel');
To find out which of them was clicked, use:
if ($form['register']->isSubmittedBy()) {
// ...
}
If you don't want to validate the form when a submit button is pressed (such as Cancel or Preview buttons), you can turn it off with setValidationScope().
addButton(string|int $name, $caption): Button
Adds button (class Button) without submit function. It is useful for binding other functionality to id, for example a JavaScript action.
$form->addButton('raise', 'Raise salary')
->setHtmlAttribute('onclick', 'raiseSalary()');
addImageButton(string|int $name, ?string $src=null, ?string $alt=null): ImageButton
Adds submit button in form of an image (class ImageButton).
$form->addImageButton('submit', '/path/to/image');
When using multiple submit buttons, you can find out which one was clicked with
$form['submit']->isSubmittedBy()
.
addContainer(string|int $name): Container
Adds a sub-form (class Container), or a container,
which can be treated the same way as a form. That means you can use methods like setDefaults()
or
getValues()
.
$sub1 = $form->addContainer('first');
$sub1->addText('name', 'Your name:');
$sub1->addEmail('email', 'Email:');
$sub2 = $form->addContainer('second');
$sub2->addText('name', 'Your name:');
$sub2->addEmail('email', 'Email:');
The sent data is then returned as a multidimensional structure:
[
'first' => [
'name' => /* ... */,
'email' => /* ... */,
],
'second' => [
'name' => /* ... */,
'email' => /* ... */,
],
]
Overview of Settings
For all elements we can call the following methods (see API documentation for a complete overview):
setDefaultValue($value) |
sets the default value |
getValue() |
get current value |
setOmitted() |
omitted values |
setDisabled() |
disabling inputs |
Rendering:
setCaption($caption) |
change the caption of the item |
setTranslator($translator) |
sets translator |
setHtmlAttribute($name, $value) |
sets the HTML attribute of the element |
setHtmlId($id) |
sets the HTML attribute id |
setHtmlType($type) |
sets HTML attribute type |
setHtmlName($name) |
sets HTML attribute name |
setOption($key, $value) |
sets rendering data |
Validation:
setRequired() |
mandatory field |
addRule() |
set validation rule |
addCondition() , addConditionOn() |
set validation condition |
addError($message) |
passing error message |
The following methods can be called for the addText()
, addPassword()
, addTextArea()
,
addEmail()
, addInteger()
items:
setNullable() |
sets whether getValue() returns null instead of empty string |
setEmptyValue($value) |
sets the special value which is treated as empty string |
setMaxLength($length) |
sets the maximum number of allowed characters |
addFilter($filter) |
modifying Input Values |
Omitted Values
If you are not interested in the value entered by the user, we can use setOmitted()
to omit it from the result
provided by the $form->getValues()
method or passed to handlers. This is suitable for various passwords for
verification, antispam fields, etc.
$form->addPassword('passwordVerify', 'Password again:')
->setRequired('Fill your password again to check for typo')
->addRule($form::Equal, 'Password mismatch', $form['password'])
->setOmitted();
Disabling Inputs
Inputs can be disabled using setDisabled()
. A disabled input cannot be edited by the user.
$form->addText('username', 'User name:')
->setDisabled();
Disabled inputs are not sent to the server by the browser, so you won't find them in the data returned by the
$form->getValues()
function. However, if you set setOmitted(false)
, Nette will include their default
value in this data.
When setDisabled()
is called, the input's value is erased for security reasons. If you are setting a
default value, it is necessary to do so after its deactivation:
$form->addText('username', 'User name:')
->setDisabled()
->setDefaultValue($userName);
An alternative to disabled inputs are fields with the HTML readonly
attribute, which are sent to the server by the
browser. Although the field is only readable, it is important to realize that its value can still be modified or spoofed by
an attacker.
Custom Controls
Besides wide range of built-in form controls you can add custom controls to the form as follows:
$form->addComponent(new DateInput('Date:'), 'date');
// alternative syntax: $form['date'] = new DateInput('Date:');
The form is a descendent of the class Container and the elements are descendants of Component.
There is a way to define new form methods for adding custom elements (eg $form->addZip()
). These are the
so-called extension methods. The downside is that code hints in editors won't work for them.
use Nette\Forms\Container;
// adds method addZip(string $name, ?string $label = null)
Container::extensionMethod('addZip', function (Container $form, string $name, ?string $label = null) {
return $form->addText($name, $label)
->addRule($form::Pattern, 'At least 5 numbers', '[0-9]{5}');
});
// usage
$form->addZip('zip', 'ZIP code:');
Low-Level Fields
To add an item to the form, you don't have to call $form->addXyz()
. Form items can be introduced exclusively in
templates instead. This is useful if you, for example, need to generate dynamic items:
{foreach $items as $item}
<p><input type=checkbox name="sel[]" value={$item->id}> {$item->name}</p>
{/foreach}
After submission, you can retrieve the values:
$data = $form->getHttpData($form::DataText, 'sel[]');
$data = $form->getHttpData($form::DataText | $form::DataKeys, 'sel[]');
In the first parameter, you specify element type (DataFile
for type=file
, DataLine
for
one-line inputs like text
, password
or email
and DataText
for the rest). The
second parameter matches HTML attribute name
. If you need to preserve keys, you can combine the first parameter with
DataKeys
. This is useful for select
, radioList
or checkboxList
.
The getHttpData()
returns sanitized input. In this case, it will always be array of valid UTF-8 strings, no
matter what the attacker sent by the form. It's an alternative to working with $_POST
or $_GET
directly
if you want to receive safe data.