是否有不支持 maxlength 的浏览器？
我公司的网站上有一个竞赛参赛页面。为了参加比赛，您需要创建一个登录名，其中只有一个电子邮件和一个 4 位数的 PIN 码。这是 PIN 字段：
<input type="password" name="contest_pin" id="contest_pin" maxlength="4" />
当用户提交表单时，系统会在我们的数据库中创建帐户，然后他们会收到一封电子邮件（我复制了该电子邮件），其中包含他们创建的电子邮件地址和 PIN。
问题是：在我测试过的每个浏览器（Mac 上的 Safari/Chrome/Firefox、Linux 上的 Chrome/Firefox、Windows 上的 IE7/8/9）中，我无法在 PIN 字段中输入超过 4 位数字。然而，我收到的几封电子邮件显示，用户创建了超过 4 个字符的 PIN 码。
这怎么可能？是否有不支持 maxlength 的浏览器？我还没有在 Opera 或任何移动浏览器上进行测试。如果他们的 PIN 码长度超过 4 位数字，那也没什么大不了的；数据库将接受更多。我只是想知道他们是如何绕过 maxlength 的。
编辑添加
有太多答案基本上都在说同样的事情，我无法单独回复所有答案。我知道我应该始终对任何重要的事情进行服务器端验证，并且我们确实有 PHP 代码来清理我们的数据，如果它非常重要，我还会有 PHP 代码强制执行 4 位数限制。它们只有 4 个字符对我们来说并不重要，所以我没有强制执行。我只是想知道为什么 maxlength 属性没有达到其设计目的，即阻止用户输入超过一定数量的字符。对于那些提出恶意脚本或 Firebug 的人，我可以 100% 确定情况并非如此。只有我们网站的注册用户（仅限于非常具体的公司会员列表）才能进入竞赛报名页面，我可以保证该列表上的大约 100 人中没有人会故意试图规避输入类型属性。
I have a contest entry page on my company's website. In order to enter the contest, you create a login, which is just an email and a 4-digit pin. Here's the PIN field:
<input type="password" name="contest_pin" id="contest_pin" maxlength="4" />
When users submit the form, the account is created in our database, and then they get an email (which I'm copied on) that contains the email address and PIN they created.
Here's the issue: in every browser I've tested (Safari/Chrome/Firefox on Mac, Chrome/Firefox on Linux, IE7/8/9 on Windows) I CANNOT enter more than 4 digits into that PIN field. And yet, several of the emails I've received show that the user has created a pin with more than 4 characters.
How is this possible? Are there browsers that don't support maxlength? I haven't tested in Opera, or on any of the mobile browsers. It's not a huge deal if their pin is longer than 4 digits; the database will accept more. I'm just wondering how they managed to get around maxlength.
EDITED TO ADD
There are too many answers basically saying the same thing for me to respond individually to all of them. I KNOW that I should always do server-side validation for anything important, and we do have PHP code in place sanitizing our data, and if it was hugely important I would also have PHP code enforcing the 4-digit limit. It's not that important to us that they be only 4 characters, so I haven't enforced it. I'm just wondering why the maxlength property is not doing what it's designed to do, which is prevent users from entering more than a certain number of characters. For those of you that suggested malicious scripts or Firebug, I can be 100% certain this is not the case. Only registered users of our site (which is limited to a very specific corporate membership list) can even get to the contest entry page, and I can guarantee that none of the approximately 100 people on that list are going to be deliberately trying to circumvent an input type property.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（6）
它们很可能是读取字段名称并根据这些名称创建 GET 和 POST 请求的机器人，而不是像普通人类用户那样使用 HTML 表单。
这就是为什么客户端的表单验证永远不足以确保数据正确。客户端验证很好，因为它对最终用户有响应，但它无法阻止不良数据到达服务器的门口。
举个例子，假设我的表单中有一个输入字段，其操作是 GET。我的输入字段的最大长度是 4。当我按下提交时，我看到以
?field=1234结尾的 URL。没有什么可以阻止我将该 URL 更新为?field=123456789并按 Enter 键。类似的事情可以通过 POST 操作完成，但需要一个工具来完成。They very likely are bots that read field names and create GET and POST requests based on those rather than using the HTML form like a normal human user would.
This is why client-side validation of form is never enough to ensure data is correct. Client-side validation is nice as it's responsive for end users, but it's not able to prevent bad data from arriving at your server's doorstep.
As an example, let's say I have an input field in a form whose action is GET. My input field's maxlength is 4. When I press submit, I see the URL ending with
?field=1234. There's nothing stopping me from updating that URL to?field=123456789and pressing enter. Similar things can be done with POST actions, but a tool is needed to do it.我相信每个浏览器都支持它，这里有一些链接供参考：
Maxlength | SitePointReference
最大长度 | W3 Schools
显然有办法解决这个问题 - 您应该确保始终有足够的服务器端验证，因为客户端通常本身是不够的。
I believe that every browser supports it, here's a few links for reference :
Maxlength | SitePointReference
Maxlength | W3 Schools
Obviously there are way around this - you should ensure you ALWAYS have adequate server-side validation, as client-side usually isn't enough on it's own.
所有浏览器都支持 maxlength。然而，可以使用 DOM 方法或例如使用 Firefox 的 Web 开发工具栏轻松删除/更改此属性。
All browsers support maxlength. However, this attribute can easily be removed/changed using DOM methods or, for example, with Firefox's Web Developer Toolbar.
我将调查与这些用户活动相关的 USER_AGENT 和 REFERER 标头。也许恶意用户以编程方式提交表单来规避浏览器限制，只是为了检查您的外围防御。如果是这样，您应该会看到一些模式。
无论如何，除了这些有根据的猜测之外，
maxlength不应被视为保护输入的一种手段。客户端的任何内容都不在您的控制之下，它的存在只是为了使用户界面更加直观、交互。您应该始终检查服务器上的所有内容。在这种情况下，PIN 由 4 位数字组成，否则拒绝输入。黄金法则是将所有用户输入视为恶意输入，并在服务器上彻底验证它。I would investigate the USER_AGENT and REFERER headers related to those user activities. Perhaps a malicious user submitted forms programmatically circumventing the browser restrictions, just to check your perimeter defense. If so you should see some patterns there.
Anyway these educated guesses aside,
maxlengthshould not be treated as a means of securing the input. Anything client-side is not under your control, it exists merely to make user interface more intuitive, interactive. You should always check everything on the server. In that case, the PIN being composed of 4 digits, otherwise reject the input. The golden rule is to treat all user input as hostile and thoroughly validate it on the server.一般来说，尝试对客户端完成的用户输入强制执行规则是一个坏主意。我有过一次经验，我们将一些工作外包给一些程序员，他们清理用户输入的想法是让用户在任何给定字段中输入的字符数不能超过 10 个。一个快速的 firebug 更改，哦，看，我可以通过一些最小的 SQL 注入来删除服务器的数据库。
如果我是你，我会使用任何将用户信息添加到数据库的脚本检查最大长度，并在用户输入超过指定的最大长度时返回表单验证错误。
In general, trying to enforce rules for user input done client-side is a bad idea. I had an experience where we had contracted out some work to some programmers and their idea of sanitizing user input was making it so that users couldn't input more than 10 characters in any given field. A quick firebug change and, oh look, I can drop the server's database with some minimal SQL injection.
If I were you I'd check maximum lengths with whatever script adds user information to your database and return form validation errors if the user input exceeds the maximum specified length.
即使客户端几乎总是支持它，您仍然应该在服务器端验证这种类型的事情。绕过最大长度非常容易——Firefox 开发者工具栏包含一个“删除最大长度”选项，或者可以很容易地手动编辑请求。我几乎认为，在过去，您只需使用剪切和粘贴即可在其中一个浏览器中绕过最大长度（例如，浏览器不会让您输入更多字符，但如果您粘贴的值超过 5 个字符，会输入所有内容），虽然我不记得具体是在哪个浏览器上看到的......
This is the type of thing that you should still validate server side, even though the clients will almost always support it. It is very easy to get around a maxlength -- Firefox Developer toolbar includes an option to "Remove Maximum Lengths", or a request can very easily be hand-edited. I almost think that in the past you could get around a maxlength in one of the browsers simply by using cut and paste(eg, the browser wouldn't let you type more characters, but if you pasted a value that was 5+ characters it would enter them all), though I can't remember specifically which browser I saw that on...