JHTML-FORM-TOKEN-001
JHtml::_('form.token')
JHtml::_('form.token') (keep this)
Tokens are not deprecated. Only the JHtml class name is. Do not delete CSRF tokens while “cleaning J3 APIs”.
JHtml::_('form.token') → HTMLHelper::_('form.token') — still required
Symptoms people search
form token · invalid token after upgrade
Replace this code
Swap JHtml::_('form.token') for HTMLHelper::_('form.token') — still required.
Joomla 3
Remove or stop calling this
echo JHtml::_('form.token');Joomla 4 / 6
Use this instead
echo HTMLHelper::_('form.token');How to fix it
- 1Keep the token.
- 2Switch JHtml to HTMLHelper.
Also known as
form.token · CSRF
Related issues
- Joomla 3 → 4Joomla API
JRequest::getVar() and the whole JRequest API
JRequest::getVar() → $app->getInput()->get('id')
- Joomla 3 → 4Joomla API
JError / JException
JError::raiseError() → throw new RuntimeException() / try-catch
- Joomla 3 → 4Joomla API
isAdmin() / isSite()
$app->isAdmin() → $app->isClient('administrator') / isClient('site')
- Joomla 3 → 4Joomla API
Factory::getUri()
JFactory::getUri() → Uri::getInstance()
- Joomla 3 → 4Joomla API
Factory::getXml() / JXMLElement
JFactory::getXML() → SimpleXMLElement
- Joomla 3 → 4Joomla API
Factory::getEditor()
JFactory::getEditor() → Editor::getInstance()