Value Attribute Required
ID |
html.value_attribute_required |
Severity |
low |
Remediation Complexity |
low |
Remediation Risk |
low |
Remediation Effort |
low |
Resource |
Reliability |
Language |
Html |
Tags |
reliability |
Rationale
For these three input types the submitted value comes entirely from the value attribute, not from
anything the user types. A hidden input with no value submits an empty string, while a radio or
checkbox with no value submits the literal on, neither of which is usually what the author
intended.
<input type="hidden" name="x"> <!-- FLAW — submits an empty string -->
<input type="hidden" name="x" value="1"> <!-- OK — explicit value -->Remediation
Add an explicit value attribute to the hidden, radio or checkbox input so the submitted data
is well defined.