DOM clobbering
- Avoid using the names of built-in
form
properties with thename
content attribute.
- can have a form owner
- form owner defaults to its ancestor
form
element
- form owner defaults to its ancestor
«button»
«fieldset»
«input»
«object»
«output»
«select»
«textarea»
«img»
- form-associated custom elements
form
element.
- are in the
form.elements
andfieldset.elements
APIs. - have a
form
content and IDL attribute used to set a form owner.
«button»
«fieldset»
«input»
«object»
«output»
«select»
«textarea»
- form-associated custom elements
form
attribute set to ID
of form
element in its tree.
- can be used in the entry list when a
form
element is submitted.
«button»
«input»
«object»
«select»
«textarea»
- form-associated custom elements
- can be affected when a
form
element is reset.
«input»
«output»
«select»
«textarea»
- form-associated custom elements
- can be associated with a label element.
«button
«input
(iftype
!=hidden
)«meter
«output
«progress
«select
«textarea
- form-associated custom elements
«maxlength
sets upper limit on number of characters: aka maximum allowed value length«minlength
sets lower limit on number of characters: aka minimum allowed value length- if empty string is not allowed,
required
must be set
- if empty string is not allowed,
Field name Meaning Canonical Format Control group
name
Full name Free-form text, no newlinesText
honorific-prefix
Prefix or title (e.g. "Mr.", "Ms.", "Dr.", "Mlle") Free-form text, no newlinesText
given-name
Given name (in some Western cultures, also known as the first name) Free-form text, no newlinesText
additional-name
Additional names (in some Western cultures, also known as middle names, forenames other than the first name) Free-form text, no newlinesText
family-name
Family name (in some Western cultures, also known as the last name or surname) Free-form text, no newlinesText
honorific-suffix"
Suffix (e.g. "Jr.", "B.Sc.", "MBASW", "II") Free-form text, no newlinesText
nickname
Nickname, screen name, handle: a typically short name used instead of the full name Free-form text, no newlinesText
organization-title
Job title (e.g. "Software Engineer", "Senior Vice President", "Deputy Managing Director") Free-form text, no newlinesText
username
A username Free-form text, no newlines Usernamenew-password
A new password (e.g. when creating an account or changing a password) Free-form text, no newlinesPassword
current-password
The current password for the account identified by the username field (e.g. when logging in) Free-form text, no newlinesPassword
one-time-code
One-time code used for verifying user identity Free-form text, no newlines Passwordorganization
Company name corresponding to the person, address, or contact information in the other fields associated with this field Free-form text, no newlinesText
street-address
Street address (multiple lines, newlines preserved) Free-form textMultiline
address-line1
Street address (one line per field) Free-form text, no newlinesText
address-line2
Free-form text, no newlinesText
address-line3
Free-form text, no newlinesText
address-level4
The most fine-grained administrative level, in addresses with four administrative levels Free-form text, no newlinesText
address-level3
The third administrative level, in addresses with three or more administrative levels Free-form text, no newlinesText
address-level2
The second administrative level, in addresses with two or more administrative levels; in the countries with two administrative levels, this would typically be the city, town, village, or other locality within which the relevant street address is found Free-form text, no newlinesText
address-level1
The broadest administrative level in the address, i.e. the province within which the locality is found; for example, in the US, this would be the state; in Switzerland it would be the canton; in the UK, the post town Free-form text, no newlinesText
country
Country code Valid ISO 3166-1-alpha-2 country code [ISO3166]Text
country-name
Country name Free-form text, no newlines; derived from country in some casesText
postal-code
Postal code, post code, ZIP code, CEDEX code (if CEDEX, append "CEDEX", and the arrondissement, if relevant, to the address-level2 field) Free-form text, no newlinesText
cc-name
Full name as given on the payment instrument Free-form text, no newlinesText
cc-given-name
Given name as given on the payment instrument (in some Western cultures, also known as the first name) Free-form text, no newlinesText
cc-additional-name
Additional names given on the payment instrument (in some Western cultures, also known as middle names, forenames other than the first name) Free-form text, no newlinesText
cc-family-name
Family name given on the payment instrument (in some Western cultures, also known as the last name or surname) Free-form text, no newlinesText
cc-number
Code identifying the payment instrument (e.g. the credit card number) ASCII digitsText
cc-exp
Expiration date of the payment instrument Valid month stringMonth
cc-exp-month
Month component of the expiration date of the payment instrument Valid integer in the range 1..12Numeric
cc-exp-year
Year component of the expiration date of the payment instrument Valid integer greater than zeroNumeric
cc-csc
Security code for the payment instrument (also known as the card security code (CSC), card validation code (CVC), card verification value (CVV), signature panel code (SPC), credit card ID (CCID), etc) ASCII digitsText
cc-type
Type of payment instrument Free-form text, no newlinesText
transaction-currency
The currency that the user would prefer the transaction to use ISO 4217 currency code [ISO4217]Text
transaction-amount
The amount that the user would like for the transaction (e.g. when entering a bid or sale price) Valid floating-point numberNumeric
language
Preferred language Valid BCP 47 language tag [BCP47]Text
bday
Birthday Valid date string Datebday-day
Day component of birthday Valid integer in the range 1..31Numeric
bday-month
Month component of birthday Valid integer in the range 1..12Numeric
bday-year
Year component of birthday Valid integer greater than zeroNumeric
sex
Gender identity (e.g. Female, Fa'afafine) Free-form text, no newlinesText
url
Home page or other web page corresponding to the company, person, address, or contact information in the other fields associated with this field Valid URL stringURL
photo
Photograph, icon, or other image corresponding to the company, person, address, or contact information in the other fields associated with this field Valid URL stringURL
tel
Full telephone number, including country code ASCII digits and U+0020 SPACE characters, prefixed by a U+002B PLUS SIGN character (+)Tel
tel-country-code
Country code component of the telephone number ASCII digits prefixed by a U+002B PLUS SIGN character (+)Text
tel-national
Telephone number without the county code component, with a country-internal prefix applied if applicable ASCII digits and U+0020 SPACE charactersText
tel-area-code
Area code component of the telephone number, with a country-internal prefix applied if applicable ASCII digitsText
tel-local
Telephone number without the country code and area code components ASCII digitsText
tel-local-prefix
First part of the component of the telephone number that follows the area code, when that component is split into two components ASCII digitsText
tel-local-suffix
Second part of the component of the telephone number that follows the area code, when that component is split into two components ASCII digitsText
tel-extension
Telephone number internal extension code ASCII digitsText
email
Email address Valid email addressUsername
impp
URL representing an instant messaging protocol endpoint (eg, "aim:goim?screenname=example") Valid URL stringURL