HTML5: Form Validation Turned Off

HTML5 validation of input form fields is disabled.

HTML5 provides a new ability to do simple input form fields validation. One can specify whether an input form field is required by using the required attribute. Specifying the field type makes sure that the input is checked against its type. One can even supply a customizable pattern attribute that checks the input against a regular expression. However, this validation gets disabled when adding a novalidate attribute on a form tag and a formnovalidate attribute on a submit input tag.

Example 1: The following sample disables form validation via a novalidate attribute.

      <form action="demo_form.asp" novalidate="novalidate">
        E-mail: <input type="email" name="user_email" />
        <input type="submit" />
      </form>

Example 2: The following sample disables form validation via a formnovalidate attribute.

      <form action="demo_form.asp" >
        E-mail: <input type="email" name="user_email" />
        <input type="submit" formnovalidate="formnovalidate"/>
      </form>

HTML forms with disabled validation are not user-friendly and can potentially expose the server to numerous types of attacks. Unchecked input is the root cause of vulnerabilities like cross-site scripting, process control, and SQL injection.