I suppose this is a hack, but seems to work well for me. Do both! User sees disabled input, clearly ghosted and browser prevents interaction - but it is not submitted with form. The user doesn't see the potentially disorienting readonly field, yet it is submitted with the form.