Hi Roger, You should never rely on the form data in your type class (as you've just discovered). When the form is constructed, you can never be certain that the data is already available and won't be changed.
In your case, I recommend to add an event listener to the preBind and preSetData events that overrides the 'city' field. class ContactType extends AbstractType { public function buildForm(FormBuilder $builder, array $options) { $factory = $builder->getFormFactory(); $refreshCity = function ($form, $state) use ($factory) { $form->add($factory->createNamed('entity', 'city', null, array( 'class' => 'Entity:Cities', 'query_builder' => function (EntityRepository $repository) use ($state) { return $respository->createQueryBuilder('cities') ->select(array('cities', 'zip_codes')) ->innerJoin('cities.zip_codes', 'zip_codes') ->where('cities.states = :state') ->setParameter('state', $state); }, 'property' => 'city_name', 'label' => 'City', ))); }; $builder->addEventListener(Events::preSetData, function (DataEvent $event) use ($refreshCity) { $form = $event->getForm(); $data = $event->getData(); if ($data instanceof ContactInfo) { $refreshCity($form, $data->getCity()->getState()); } }); $builder->addEventListener(Events::preBind, function (DataEvent $event) use ($refreshCity) { $form = $event->getForm(); $data = $event->getData(); if (isset($data['state'])) { $refreshCity($form, $data['state']); } }); Obviously this is untested, but I think this should work (with probably minor modifications depending on your form). Bernhard -- If you want to report a vulnerability issue on symfony, please send it to security at symfony-project.com You received this message because you are subscribed to the Google Groups "symfony users" group. To post to this group, send email to symfony-users@googlegroups.com To unsubscribe from this group, send email to symfony-users+unsubscr...@googlegroups.com For more options, visit this group at http://groups.google.com/group/symfony-users?hl=en