greyed out text fields

The Mighty Dubs

Hi Guys,

Anybody know a quick way to make form text fields greyed, displaying info in them but to have them uneditable..

Cheers

akari no ryu

The Mighty Dubs wrote:

Hi Guys,

Anybody know a quick way to make form text fields greyed, displaying info in them but to have them uneditable..

Cheers

<input type="text" name="blah" disabled="disabled"/>

With javascript, you edit this with

myForm.blah.disabled=true;
myForm.blah.disabled=false;

dangerman

also readonly

<input type="text" name="blah" readonly="readonly"/>


i think disabled doesn't submit the info to the server, whereas readonly does. <-- i may be mixing this up with an application specific thing though.

The Mighty Dubs

legendary

akari no ryu

dangerman wrote:

also readonly

<input type="text" name="blah" readonly="readonly"/>


i think disabled doesn't submit the info to the server, whereas readonly does. <-- i may be mixing this up with an application specific thing though.

I think you're right, actually. It's been a while since I've done any front end html stuff other than to work with js.

seamus

Correct, readonly does submit to the server.

Be aware of security concerns. Let's say for example, you're coding a script for a User Control Panel where users can see their details. One detail is their access level.
Unless the user has access level "Administrator", you don't want the users to be able to change this, but you do want them to see this.
If you use "readonly", the access level field is submitted to the server along with any other changes. But the user can't change the access level field, right? Wrong. Plenty of handy plug-ins exist (I'm using one right now) that allow you to change fields from readonly to editable on-the-fly.
If you use "disabled" (and don't use a "name" attribute), the field doesn't get submitted to the script, and you've closed off one possible avenue of hacking.

akari no ryu

seamus wrote:

Correct, readonly does submit to the server.

Be aware of security concerns. Let's say for example, you're coding a script for a User Control Panel where users can see their details. One detail is their access level.
Unless the user has access level "Administrator", you don't want the users to be able to change this, but you do want them to see this.
If you use "readonly", the access level field is submitted to the server along with any other changes. But the user can't change the access level field, right? Wrong. Plenty of handy plug-ins exist (I'm using one right now) that allow you to change fields from readonly to editable on-the-fly.
If you use "disabled" (and don't use a "name" attribute), the field doesn't get submitted to the script, and you've closed off one possible avenue of hacking.

I agree with Seamus. You really shouldn't be using a form element to store that kind of information, that's what sessions were made for

Eoin

akari no ryu wrote:

I agree with Seamus. You really shouldn't be using a form element to store that kind of information, that's what sessions were made for

Actually, after reading Seamus' post this morning, I checked this on a system I wrote for work, and sure enough was able to do exactly what he said.

Sessions can help, but you have to use them correctly. For instance, I viewed the source of the form and saved it to my PC. I amended the HTML so the "action" of the form was pointing to the original one on the webserver. I changed the value of the form fields to whatever I wanted, and hey presto - I could get admin access to the application

I had been checking Session state, but all I had to do was log in to the system with one tab on Firefox, and execute the form in another tab so a session was active. Can't believe I had written such an insecure application - just glad that it's an internal app that doesn't contain and sensitive info.

dangerman

eoin_s wrote:

Sessions can help, but you have to use them correctly. For instance, I viewed the source of the form and saved it to my PC. I amended the HTML so the "action" of the form was pointing to the original one on the webserver. I changed the value of the form fields to whatever I wanted, and hey presto - I could get admin access to the application

Yep. I've seen people forget this fact. In an ecommerce system.