Do all browsers ignore nameless input fields?
-
05-07-2021 - |
Question
Is it guaranteed that a browser doesn't send an input element if it doesn't have the name attribute specified?
For example, can we assume that POSTing the form below won't send the credit card number?
<form action="/process" method="post">
<input id="credit-card-number" type="text">
<input type="submit" name="commit" value="Go">
</form>
Solution
Is it guaranteed that a browser doesn't send an input element if it doesn't have the name attribute specified?
Yes (unless you muck about with JavaScript to change that).
The specification is quite clear that controls without names cannot be successful.
A successful control must be defined within a FORM element and must have a control name.
OTHER TIPS
The standard says that to send an input it should be a successful "control."
If a control doesn't have a name
it's not a successful "control," so it should not be sent.