Form Styling and Security

[]|V|[agnus]

Once upon a time, I complained about Opera's lack of support for styling input buttons. I was quickly told that this is 'proper', as allowing styling of things like form inputs is a potential security risk.

While I understand part of that point of view, I don't think the notion of form styling ought to be demonized as it has been in my experiences. It's like the notion of prohibition of just about anything: is it better to not allow the choice, or allow choice but encourage responsible decisions?

I believe in the latter firmly. Responsible Web developers will style consciously and jerks and hackers will always find ways around any precaution.

I think people ought to be given some credit and freedom.

Why do those that are relatively opposed to the notion, or other similar situations, feel the way you do?

Opera has since included support for styling of input buttons, which was my main gripe. Kudos to Opera.

[raf]

as you say; it wount add much security to disallow styling. users click on anything anyway (even if you show them a dialog with a certificat for another domain, they'll just accept it)

i am however 100% against it because i like a uniform surfing experience where all sites use the same conventions for there formfield and formactions. it makes filling out a form clearer for less intelligent people like myself.

just because they can be styled, lotts of clients ask to have some sort of 'styled' button, scroolbar etc, which usually just adds to the kitchyness of there site.

just my € 0.02

[Willy Duitt]

I would estimate that less than 1% of the sites that are available on the WWW are coded by professional developers, the rest being scripted by rank amateurs whom tend to add every javascript gizmo, flashing text, marquee scrolling, alert popping thingamabob to their documents without concern for accessibility or compatability and I can just imagine what they would do with a form if they could style a button to not look like a button. All in the name of cuteness....

And to take it alittle further, regardless of how accurate my estimate is, how many professional developers do you think are actually responsible enough to forsake the almighty dollar and refuse to bow to a clients wish to abuse form button styling if it was available? I would think less than 1% of the 1%. Else the exploits of homepage hijacks, browser closings, cookie stealing, no right clicking, ect. would not be so prevalent....

JMHO;
.....Willy

[]|V|[agnus]

i am however 100% against it because i like a uniform surfing experience where all sites use the same conventions for there formfield and formactions. it makes filling out a form clearer for less intelligent people like myself.

But even that consistency is merely OS specific, or even browser specific in the case of Opera, or at least the way Opera used to be. So then I think it still comes back to the responsibility of the developer to ensure that the form looks like a form, and that look can depend on the rest of the site.

I would estimate that less than 1% of the sites that are available on the WWW are coded by professional developers, the rest being scripted by rank amateurs whom tend to add every javascript gizmo, flashing text, marquee scrolling, alert popping thingamabob to their documents without concern for accessibility or compatability and I can just imagine what they would do with a form if they could style a button to not look like a button. All in the name of cuteness....

And to take it alittle further, regardless of how accurate my estimate is, how many professional developers do you think are actually responsible enough to forsake the almighty dollar and refuse to bow to a clients wish to abuse form button styling if it was available? I would think less than 1% of the 1%. Else the exploits of homepage hijacks, browser closings, cookie stealing, no right clicking, ect. would not be so prevalent....

I think you have a very elitist perspective. I understand the crux of what you are trying to say, but this type of negativity only serves to limit us. Even if you're arrogant statistics were at all accurate, and 99% of developers were unworthy noobs, that wouldn't change the fact that a styled form has nothing to do with how secure, accessible or functional it is BY DEFAULT. Styling can of course be abused like anything else, but as I said at the onset, to demonize it completely because you personally don't like it and/or think you're better than the "noobs" that use it, or because SOME jerks ruin it for the rest of us, is unfair.

[circusbred]

Okay, this has only served to confuse me...What's so dangerous about a styled form?

[gsnedders]

People are used to how forms look in the browser they use, and it you change what it looks like they may not reconize it as a form, and also, it can get annoying when you have a web browser, with all the buttons and controls made to look exactly like the operating system, like Safari.


Just my €0.02 (I'm going to Germany on Tuesday so I'm using Euros now).

[]|V|[agnus]

Circusbred,

I believe the reservations with styling forms with regard to security have to do with hypotheticals like somebody styling a button to look like an image that says, "Click here to win $10!" and then it submits a form whose action is to run a page which exploits a security flaw in the browser or OS or something. There are probably better examples, but basically, the concern is over, once again, the jerks and bad apples that do stuff like that. So then irrational people come in and say, "We need to eliminate the chance of that happening by eliminating the choice!" This is of course absurd, but yet we have to deal with those people same as we have to deal with jerks that abuse form styling.

*sigh*

[raf]

|V|[agnus']Circusbred,

I believe the reservations with styling forms with regard to security have to do with hypotheticals like somebody styling a button to look like an image that says, "Click here to win $10!" and then it submits a form whose action is to run a page which exploits a security flaw in the browser or OS or something. There are probably better examples, but basically, the concern is over, once again, the jerks and bad apples that do stuff like that. So then irrational people come in and say, "We need to eliminate the chance of that happening by eliminating the choice!" This is of course absurd, but yet we have to deal with those people same as we have to deal with jerks that abuse form styling.

*sigh*
You obviously completely missed the point.

Being able to submit a form on a usersaction has nothing to do with styling of formelements. The user doesn't even need to see the form before it get submitted.

The whole 'secutiy'-issue is completely beside the point. There is no way to add extra security to a form (if such thing even exists, a secure form) by disallowing styling of form or window-elements.

The only reason why i am against styling formelements, is that changing the appearance and function of formelements can confuse users. And your 'argument' that it s browserspecific and OS specific... I can only laugh with that. Most inexperienced userd only use one browser and only acces the web with one machine (lets say they are all windows - IE users?) I of course wasn't refering to people using macs and windows and browing with opera or whatever marginaly used browser.
You dare to call us irrational?

Maybe check out some sites of the large companys in your contry. There forms will all be created by irrational people that believe in software ergonomics. (very boring developpers to that believe more in accesebility and standardcompliance then flashing buttons)
In professinal coding, it should not be done. As soon as i see a textbow with a coloured background, i know there was an amateure at work


This is of course absurd, but yet we have to deal with those people same as we have to deal with jerks that abuse form styling.

Your whole reaction is absurd. I don't mind that people would style formelements. It's just not something you do if you are a coding-professional that creates sites for the general public. From what i read, i don't think mr Duitt thinks differntly

Just curious. How is "we" (still need to see a second poster that shares your point of view) gonna deal with "those people". I assume you refer to "SOME jerks " that "ruin it for the rest of us" (us, us,us. me, myself and i is making a big fuss) which "is unfair".

Lets talk again after you created a site for a company that wants his site to be accesible and correctly used by as many clients as possible.

[]|V|[agnus]

Easy champ..

First, you assumed that by "those people" I meant you and apparently Mr. Duitt as well. Well, in reality, the only thing in common you share with the characters in my illustration is that you do not approve of form styling. Your reasoning may be different, and if so my reaction would be too.

Second, perhaps most inexperienced users use only one machine, but most users aren't necessarily inexperienced, and stepping back, "experience" ultimately has little to do with the conditions that might result in an individual using multiple machines to access the Web. If my comment about OS specific input styles made you laugh, you've not heard real comedy my friend.

Lastly, whether or not I've contributed to a site as large as the largest one you've contributed to isn't really relevant to what I'm talking about. My opinions do not require experience for validity. You're missing my points as well: you keep emphasizing what *can* happen and what *some* people do as if they are certainties to which our only solution is a boycott on something which is not inherently wrong. It's funny because by using "can" in your own argument, you affirm that fact! That form styling is not *inherently* wrong.

:)

[raf]

since you seem to be a bad reader, i'll make it simple for you:

- the appearance of a formalement has nothing to do with security. all formactions can be done with clientside sripting so your whole question is absurd.
- conventions about the appearance and functions of formelements serve 1 purpose : avoid mistakes by the enduser by ensuring that all formelement on all sites have the same appearance and function. They do not try to 'restrict creativity' or to restrict you to give your forms the same look and feel as the rest of your site. In my opinion, all formmanipulation through clientside scripting should even be avoided, because they can confuse your users.
if you are concerned about accesebility and avoiding mistakes by your users, then you don't styling on formelements.

now lets see what a bad reader i am:

First, you assumed that by "those people" I meant you and apparently Mr. Duitt as well. Well, in reality, the only thing in common you share with the characters in my illustration is that you do not approve of form styling. Your reasoning may be different, and if so my reaction would be too.
The characters in your illustration. Hmm. Let me reread it ...
It's not clear to me who you are refering to else. Maybe contact "those people" and let them know what you think, or try to explain to me who exactly you are refering to ...
When we talk about standard-compliance and conventionissues, there is no "them", there is only "we"
But could you bother to the react to my arguments? (not with babling about users that run opera etc, but by telling me why accesability and not creating risks for usererrors are less important then styling formelements.)
Second, perhaps most inexperienced users use only one machine, but most users aren't necessarily inexperienced, and stepping back, "experience" ultimately has little to do with the conditions that might result in an individual using multiple machines to access the Web.
Euh... your right. I am a bad reader and my attentionspan is to short to find any logical meaning in your argument. I can onluy suppose that you don't understand what "by as many clients as possible" means.
(And to think that i intentionaly moved that recap to the very last line of my post so that i might hang on as the central argument ... I'm probably a bad poster too. I might as well confes : i'm ust to bad of a designer so i'd like to see all designoptions prohibited so that my own shortcomings don't show)
If my comment about OS specific input styles made you laugh, you've not heard real comedy my friend.
Again my bad. I'm such a boad poster. Of course, i didn't mean your argument about "OS specific input styles ". I meant that that argument is just redicilous if we are talking about peoplethat get confused by styled formelements. Usually mac-users (has IE fro Mac realy that different looking formelements?), and certainly opera or safari users have some web-experience and are able to fill out a form correctly.
Most inexperineced users (about 100%?) will always acces the web on a win-IE machine. That this, in theory, doesn't allways need to be true. OK. I'll give you that. (but only since it doesn't change anything about the premisse : "as many clients as possible"
I confes : i've never heard real comedy. I don however faulty logic arguments and irrelevant arguments that aren't much more then a bit of windowdressing (aint that an appropriate use of that term?) because you have nothing set against the mainpoint : inexperienced users make less mistakes with standard formfield-appearences.
Lastly, whether or not I've contributed to a site as large as the largest one you've contributed to isn't really relevant to what I'm talking about. My opinions do not require experience for validity.
No here you are dropping the ball, my friend.
You see, i don't talk about "large sites". Here you show as a bad reader.
I use words like "sites for the general public" and "a site for a company that wants his site to be accesible and correctly used by as many clients as possible." (see, i slipped it in again : "as many clients as possible" --> that's the trick of the broken gramophon : repeating it over and over again. I'm so pleased with myself ! (of course, by doing this so manifestly and disclosing why i repeated it, it's only gonna be frustrating you. ahh. well. whatever trick that could maybe make you remember it is valid.))
I used "large companys". But that is because:
- "compnays" try to sell something. The try to make a profit, ad in most case, like to keep the source of their profit (the client) happy. They want to avoid loosing buiness because of inaccesible or confusing websites. (what they surely can do wthout are angry mails from people 'not abe' to use their site)
- "large" --> professional, accesible, standardcompliant coding costs. The larger the company, the more diverse their potental visitors are and the more standardcompliance and accesability.
You're missing my points as well: you keep emphasizing what *can* happen and what *some* people do as if they are certainties to which our only solution is a boycott on something which is not inherently wrong.
I'll try it onec more : "accesible and correctly used by as many clients as possible." Every client that can't fill out the form is an displeased client you might loose business from.
But even for personal sited : if you have a form, then this means you'd like to get some input from them. An unsuccefull client = another failure for you
It's funny because by using "can" in your own argument, you affirm that fact! That form styling is not *inherently* wrong.
Funny? "you've not heard real comedy my friend". I must be unintentionally funny (sooo pleased with myself. I wish everyone was like me, so that all sites would look like i wan't them to look.)
I'm using "can" in my argument. Let me look that up ...
Hmm. All i can find is
"just because they can be styled, lotts of clients ask to have some sort of 'styled' button, scroolbar etc, which usually just adds to the kitchyness of there site"
So that is "affirm that fact! That form styling is not *inherently* wrong".
Now you lost me completely. (My self-asteem gets a small dip now).
I think my position is quite clear. i hope it at least is after this post. Ahh, why not once more : if you want your forms to be accesible and correctly used by as many clients as possible, then you will not use styling on inputbuttons.

If you wanna use it, then go ahead! But it should not be done if you want your forms to be accesible and correctly used by as many clients as possible. And i always use that argument againt clients with similar requests.