Toby Inkster <> wrote:
> Browsers can happily ignore maxlength, so if length is important to
> yout
you *must* enforce the length limit at the server side.
The conclusion is correct, but I disagree about the premises. The maxlength
attribute is defined as imposing a limit on the amount of text entered in a
text input field. It very much looks like browsers are required to
implement that limit, and that they actually do so.
But nothing prevents a user from copying a form and editing it, so that the
maxlength attribute is changed or removed, or writing a completely
different form with the same action attribute. This could happen out of
malevolence or cracking attempt, or through an attempt to create a
"customized form" (e.g. for personal use) plus some technical error in
doing that. In any case, such possibilities are a fundamental reason for
making form data handling robust - it should be prepared to literally
anything, including data that cannot result from submitting the form!
--
Yucca,
http://www.cs.tut.fi/~jkorpela/
Pages about Web authoring:
http://www.cs.tut.fi/~jkorpela/www.html