Are <input> fields without a name attribute submitted to the server?

Question

Lets say I have two input fields inside a form, like so.

<form class="my-form" method="POST" action="/my/receiver"> <input id="input1" name="inputfield1" /> <input id="input2" placeholder="More input" /> <input type="submit" value="Submit form" /> </form>

If I am running a server that will listen to a form submission on that link, I know for a fact that #input1 will be sent to the server as data. However, since #input2 does not have a name, will this be sent to the server?

If you answer yes / no, is this standard HTML/HTTP behavior? Can I rely on this in a production application?

Note: I'm asking this question because I do not want some info sent from my form (due to security and liability reasons), and I want to ensure that it is not sent.

Niet the Dark Absol · Accepted Answer · 2014-06-29 00:04:52Z

5

An input element with no name is never submitted to the server.

That said, <input> is probably the wrong tool for the job if you specifically don't want it sent.

answered Jun 29, 2014 at 0:04

Niet the Dark Absol

326k86 gold badges480 silver badges604 bronze badges

Sign up to request clarification or add additional context in comments.

6 Comments

Brendan Over a year ago

Do you have any recommended way to have something function exactly like an input element then? textareas would not work, but I need input from the client.

Niet the Dark Absol Over a year ago

I'm afraid I don't understand. You need input from the client, but you don't actually want it sent?

Brendan Over a year ago

Well, I take the input, then it gets sent off to a third party service. I then get a new value which I want - I insert that via jQuery as an input type="hidden. However, I still have the rest of the inputs in the form, but don't want them sent.

Niet the Dark Absol Over a year ago

Perhaps you need two <form> elements then. One to send to the third-party service (I thought you said this was for security and liability reasons? Third-party thing really a good idea?) and a second form for actually sending to you.

Niet the Dark Absol Over a year ago

Assuming you're using HTTPS (as you should be) then there's no harm in sending the details to your server, if all you're doing is discarding them afterwards. But, two forms will make your web requests tidier, and any suspicious person looking at the Network tab of their dev tools will see clearly whether or not you get the info sent to you. :)

|

Collectives™ on Stack Overflow

Are <input> fields without a name attribute submitted to the server?

1 Answer 1

6 Comments

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

6 Comments

Linked

Related