I have a custom admin module in my magento website. I use a custom form submission. Here is my module.xml file

<?xml version="1.0"?>
    <update handle="courses_book_update"/>
    <reference name="content">
       <block type="courses/adminhtml_update" name="update" template="courses/update.phtml"/>

and here is my phtml file.

   <h3>Add Dates</h3><hr>
   <table cellspacing="0" class="form-list" id="date_tbl">
     <form id="edit_form" name="edit_form" method="post" action="<?=$this->getUrl('*/*/update')?>">
            <td class="label">New Date 1</td>
            <td class="input-ele"><input type="text" name="date[]" id="t1" /></td>
            <td class="img"><img src="<?=$this->getSkinUrl('images/grid-cal.gif')?>" alt="" class="v-middle" id="dt1" title="Date selector"></td>
        <tr id="date2">
            <td class="label">New Date 2</td>
            <td class="input-ele"><input type="text" name="date[]" id="t2" /></td>          <td class="img"><img src="<?=$this->getSkinUrl('images/grid-cal.gif')?>" alt="" class="v-middle" id="dt2" title="Date selector"></td>
        <tr id="date3">
            <td class="label">New Date 3</td>
            <td class="input-ele"><input type="text" name="date[]" id="t3" /></td>
            <td class="img"><img src="<?=$this->getSkinUrl('images/grid-cal.gif')?>" alt="" class="v-middle" id="dt3" title="Date selector"></td>
    <table cellspacing="0" class="form-list">
            <td class="label"><button onclick="editForm.submit()" class="scalable save" type="button"><span>Add Dates</span></button></td>

<script type="text/javascript">
    var editForm = new varienForm('edit_form');

When I submit the form, it redirects to the admin home page (dashboard). What am I doing wrong? Please help me with this.


2 Answers 2


You are missing the form_key. To protect against CSRF attacks all the backend forms use a security key witch is generated for each session. Each POST request must contain this security key.
So add this inside your form:

    <input type="hidden" name="form_key" value="<?php echo Mage::getSingleton('core/session')->getFormKey() ?>">

Assuming you have the controller properly setup to handle the update action, this should work:

<form id="edit_form" name="edit_form" method="post" action="<?=Mage::helper("adminhtml")->getUrl("*/*/update")?>">

A secret key should be added to the action when using admin URLs:


Also, it's a good practice to use <?php opening tag instead of just <? to make your code more compatible. Note that <? is a shortcode that some disable this in the setting.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.