Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HTML Form Validation is underused

expressionstatement.com

Post reply on HN
Print view View original

81–90 of 343 posts

Re: HTML Form Validation is underused

#81

Post by makeitdouble »

moron4hire wrote: post #70
jansommer wrote: post #66

Html form validation is great. There's just one gigantic catch: It doesn't work in Firefox for Android. https://bugzilla.mozilla.org/show_bug.cgi?id=1510450

Firefox for Android has a smaller user base than Samsung Internet and Opera. It's 0.5%. It's a waste of time working on supporting it. Especially considering how little time people put into making sure their sites work for people using accessibility software. I don't think it's worth mentioning in these issues unless you're also ready to talk about UC Browser.

I wanted to quickly check the 0.5%, and see 1.2% in Japan for instance, where iPhone have near 80% share.

https://gs.statcounter.com/browser-market-share/mobile/japan

That's still not a lot, but above 1% is a decent threshold to decide to support a browser.

Re: HTML Form Validation is underused

#82

Post by thrdbndndn »

yjftsjthsd-h wrote: post #25
mannyv wrote: post #24

The real problem with client-side validation is you can't trust it. You need to revalidate on the server, no matter what.

It's not a security feature, it's a UX feature.

I'd argue it's often an anti-feature.

These validation at input can be super annoying when you're copy-pasting your strings from other sources, and want to edit them in textbox in-place. Especially if you're on your phone.

I've be frustrated by this on numerous websites, a lot.

Re: HTML Form Validation is underused

#83

Post by Jerrrrrrry »

woodpanel wrote: post #53
Jerrrrrrry wrote: post #39

Earlier quoted context omitted.

> (Also kinda anoying to have to duplicate this tho) Security and convenience are like space and time, you can't move one without transformation of the other.

You could fill those setCustomValidity() calls in the client with rule-sets generated on the server. even re-fetch them from the server on each input change in the client or just ditch the whole thing and do it in htmx :->

Could you not remove the event from the input change, replacing it with NOP?

htmx looks dope af thanks

Re: HTML Form Validation is underused

#84

Post by lelanthran »

mananaysiempre wrote: post #60
nikeee wrote: post #31

Earlier quoted context omitted.

I avoid the use of `type=number` and use `type=text inputmode=numeric` instead. It doesn't come with these arrow buttons which most users don't need anyway for entering numbers. Also the keyboard is better on iOS.

> these arrow buttons A spinner control, that is. Spinners always puzzled me, to be honest. There is obviously a need for a compact numeric input control that both displays the exact value and allows rough changes using the mouse. Witness knobs in DAWs—which don’t actually work the way you’d expect from their appearance, you’re supposed to grab and then drag in a linear fashion, possibly ending outside the knob’s scr…

> Spinners are obvious, but they are also needlessly fiddly to use with the mouse

I think that a quick improvement would be to let the mouse wheel "spin" the number up/down when the input element is focused.

An even better improvement would be having the `` element actually display the value as it changed, and allow the user to set that value directly (say, by typing it in).

Right now, range is useless because the user cannot tell what is selected. The developer has to add in extra JS magic to let the user set range to an exact value, or to show the user the value they have chosen.

If `range` is improved in this way, then spinners are redundant and can be ignored.

Re: HTML Form Validation is underused

#86

Post by sholladay »

bryanrasmussen wrote: post #78
mattmanser wrote: post #36

Earlier quoted context omitted.

A bit perplexed by your comment. That wasn't a main reason people started using javascript. I even remember when people started evangelizing client-side validation in the mid-2000s. Javascript was already a normal tool used in web apps by then, and most web developers would regularly be adding javascript to their apps. Back then it was a bit of a pita as you had all sorts of gotchas with javascript memory leaks by re…

probably they mean why people started using JS in form validation, and not JS altogether, although agree that isn't the reason either.

Correct, I meant that client-side validation driven by JS became popular because of UX issues when using pure HTML. There have always been plenty of other reasons to use JS with forms besides validation. But it’s notable because forms and form validation are such common building blocks that if people feel the need to use JS there, it kind of infects everything else around it. IMO, being able to build high quality form experiences without JS is critical to reducing bloat on the web.

Re: HTML Form Validation is underused

#87

Post by Jerrrrrrry »

kadoban wrote: post #67
Jerrrrrrry wrote: post #37

Earlier quoted context omitted.

True, but if there's a communication bug between UX and back-end teams, that can escalate into a false sense of security and then an exploit.

What the hell back-end team relies on their front-end teams to tell them to do input checking? Nothing my front-end people could possibly do would trick me into trusting user input.

in 2025? you'd hope not

but also cross-system context switches, amateur RegExp, escape character (ab|mis)use, etc. can make "user-input" propagate farther than any one team's boundaries.

assertions/test coverage/fuzzing at every boundary so user-input taint analysis can't fail is a requirement for a system that passes user data around more than one time or tech stack.

Re: HTML Form Validation is underused

#88

Post by ozaark »

mcflubbins wrote: post #52

If you have a checkbox with a label, please a "for" attribute to the label so I can disable/enable the checkbox by clicking the label. This is one of my biggest pet peeves, maybe its just me.

Not just you it's a required feature of accessible sites following ADA/WCAG.

Re: HTML Form Validation is underused

#89

Post by [deleted] »

354896547981565 wrote: post #44
DaiPlusPlus wrote: post #40

Last time I checked, web-browsers today still do not allow you to style the appearance of built-in HTML validation messages [1]; this wouldn't be so bad if Chrome (and Firefox) still conformed to their OS platform UI guidelines (i.e. so it looks system-generated, like how `title=""` tooltips used to be), instead Chrome uses this ugly yellow/orange icon color with black-text on a white background on a bubble with a fi…

True. But you can hide the default message and replace it with your own. You'll still benefit from the form validation.

[deleted]

Re: HTML Form Validation is underused

#90

Post by Jerrrrrrry »

wolrah wrote: post #77
Jerrrrrrry wrote: post #37

Earlier quoted context omitted.

True, but if there's a communication bug between UX and back-end teams, that can escalate into a false sense of security and then an exploit.

> True, but if there's a communication bug between UX and back-end teams, that can escalate into a false sense of security and then an exploit. How so? The backend ALWAYS validates. No communication necessary, whether or not the frontend also validates doesn't matter to the backend. Frontend validation is to improve user experience, nothing more.

  >The backend ALWAYS validates.
Exactly. Sometimes in a system so big compartmentalization is required yet meta-communication is inhibited, that comfort-ability can lead to false asserts / assumptions.

"We always validate - no need for _me_ to do it" type bystander effect / diffusion of responsibility.

Post reply on HN