Question

If the user Fake a form and change an input to ROLE, he can change that field in database.
How can I protect Yii Forms over fake inputs?

Model Users.php

array('role', 'numerical', 'integerOnly'=>true),

Answer 1

You can’t ‘protect forms’. You need to move that data away from the client (ie. forms) and on to the server (ie. php) via a session or some other method of storing state.

As long as the user’s machine is responsible for setting the data (ie. through a form) then they can change it to whatever they want. If you don’t have a way of independently verifying that on the server-side, then don’t expect the form to send you something you can trust.

Regarding sessions, see: http://www.yiiframework.com/doc/api/1.1/CHttpSession

Verbose blurb from the Common Weakness Enumeration project (http://cwe.mitre.org/data/definitions/807.html):

Store state information and sensitive data on the server side only.
Ensure that the system definitively and unambiguously keeps track of
its own state and user state and has rules defined for legitimate
state transitions. Do not allow any application user to affect state
directly in any way other than through legitimate actions leading to
state transitions.