I believe that the only safe way to present a form field as read-only, and to prevent your form from accepting a new value in the request, is as follows.
$builder->add( 'description', TextType::class, ['disabled' => true] );
Another suggestion to use ['attr' => ['readonly' => true]] or ['attr' => ['disabled' => true]] will make you vulnerable to fake requests.
Both last parameters will set the readonly only or disabled attributes in the field, but your form will still accept a new value for this field if it is included in the request.
Only the first option above will disable the form field, and also will not allow your Form to accept a new value for the field in the request.
I tested this with Symfony Form 3.4. I do not know if 4 behaves the same.
source share