Typed, length-capped fields: why every input needs a type and a maxlength
Sentinel fails a page if any of its text fields is missing a type or a maxlength, and any textarea is missing a maxlength. Both attributes are small, and both make a form behave better for honest visitors and worse for abusive ones. They're the first layer only: Anticode's server validates every field again when the form arrives, because anything in the browser can be bypassed.
What type and maxlength each do
- type
- Tells the browser what the field holds.
emailbrings up a keyboard with @ on phones and checks the address format before sending;telbrings up a number pad;textis the plain default. Writing it out makes the intent explicit, and autofill works better when fields say what they are. - maxlength
- Caps how many characters can be typed or pasted. It stops someone pasting a novel into a name field, keeps stored data a predictable size, and catches the most obvious junk before it's ever sent.
Neither is a security control on its own. Anyone can send a form without a browser at all, or edit the page in developer tools. Their value is in setting a clear expectation in the page that the server then enforces.
What Sentinel checks
The check takes every input on the page except hidden fields, radio buttons and checkboxes, plus every textarea. Each input must have a type attribute and a maxlength above zero; each textarea must have a maxlength above zero. The Report tab shows “Text fields are typed and length-capped” with the number of fields checked. Radio buttons and checkboxes are left out because they don't take typed text; the booking calendar's day and time choices are radio buttons, so they aren't counted.
The limits Anticode's forms use
| Field | In the page | On the server |
|---|---|---|
| Name | type="text", maxlength="80" | Required, trimmed, 80 characters at most |
type="email", maxlength="120" | Required, lower-cased, must be a valid address, 254 characters at most | |
| Phone (booking form) | type="tel", maxlength="20", a pattern of digits, spaces and + ( ) - | 7 to 20 of the same characters |
| Message (contact form) | textarea, maxlength="2000" | Required, 2,000 characters at most |
| Service, day and time (booking form) | A list and radio buttons | The service is capped at 80 characters, the day must be a bookable date and the time a valid 24-hour time |
The browser's email limit is tighter than the server's on purpose: very few real addresses are longer than 120 characters, and the server keeps to the longest address the standards allow.
Why the server checks again
When a visitor sends a form, Anticode's server checks it before storing anything. The post must come from the site's own pages, and it's rate-limited per visitor and per site. Only ordinary form encoding is accepted, and a post larger than 16 KB is turned away before it's read. Then each field is checked against the rules in the table above. A form that fails gets a polite page asking the visitor to go back and check it; nothing is stored. Custom forms tied to a site function follow the same pattern with their own limits: between one and thirty fields, each up to 1,000 characters of plain text.
That's why the maxlength in the page can be relaxed by an attacker without harm. The server's limit is the one that counts. For the wider picture, see the guide to storing form data safely.
Choosing limits for your own forms
- Generous but finite. Long enough for real people, including double-barrelled names and long company addresses. Eighty characters for a name is plenty.
- Same limit both sides. If the browser allows more than the server, people type something that's then refused, which is frustrating.
- Show the limit on long fields. For a message box, say how much room there is.
- Pick the right type.
email,tel,urlandnumberall bring better keyboards on phones.
Limits
- Presence, not size. Sentinel checks that a maxlength exists, not that it's sensible. A cap of 100,000 passes.
- Built-in forms have fixed fields. You can't add a field to the contact or booking form; a form with other fields is a custom form or an app build. See contact form fields for what to ask.
- Spam is a separate problem. Length limits don't stop a bot filling every field politely; rate limits and the same-site check do more of that work.
Questions people ask
Is form input maxlength enough to protect a form?
No. It shapes what the browser sends, but anyone can bypass the browser. Anticode's server validates every field again before storing it.
How long can a contact form message be?
Up to 2,000 characters, in the page and on the server.
Do radio buttons and checkboxes need a maxlength?
No. Sentinel leaves them out of this check because they don't take typed text.