Note that there are some explanatory texts on larger screens.

plurals
  1. POMystery .x and .y form fields - where do these come from?
    primarykey
    data
    text
    <p>Take a look at <a href="https://www.drlaura.com/site/member/login/" rel="nofollow">this login page</a>, specifically, the form in the section labeled Returning Members. As you can verify by looking at the HTML or by digging with a tool such as Firebug, the actual form contains four tags: one each for the email address and password, an invisible input called "memberAlready" that contains the value "yes", and a submit button in the form an image. So far, perfectly generic.</p> <p>However, if you inspect the form data at the point at which the form is submitted (using <a href="https://addons.mozilla.org/en-US/firefox/addon/tamper-data/" rel="nofollow">Tamper Data</a> or its equivalent on another browser, you'll see that two additional form fields have been sneaked into the response: ACTION(loginCheckout).x and ACTION(loginCheckout).y. </p> <p>They both have two-digit integer values, which suggests that they're only there to verify that the submitter is an actual web browser and not a robot. Presumably, they are related somehow to the submit button, which is defined as follows:</p> <pre><code>&lt;input type="image" name="ACTION(loginCheckout)" value="Login" src="/images/login/login.gif"&gt; </code></pre> <p>What's confusing to me is that these extra form fields appear <strong>even when JavaScript is disabled in the browser</strong>. So they presumably aren't just something inserted by an event handler somewhere. </p> <p>Furthermore, if you submit the form programmatically (e.g., by running document.forms[1].submit() in the JavaScript console), the extra fields <strong>are not</strong> generated and the login attempt fails. That suggests to me that the insertion of the fields depends on something outside the basic HTML form submission mechanism. But what that "thing" could be if it's not JavaScript, I don't know.</p> <p>Does anyone recognize this pattern or have a theory as to how the validation fields are inserted?</p>
    singulars
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload