TextArea Max length

[javascripter]

Hi , I have found bug in textarea maxlength code.
The steps to reproduce the bug.
1) Copy some text from anywhere.
2) Right click in the text area and paste it.
3) Note, you will have text area with more than 10 chars.
http://www.dynamicdrive.com/dynamici.../maxlength.htm

[djr33]

There are ways to hack this.

I think, though, that the point is simply to limit people and make it CLEAR that you have a limit of 10 or 30 or whatever.
After that, it's up to the form interpretation page to cut it off at 10 or 30, etc, for security, just in case someone did decide to get around this.

with enough messing around, you can type a couple extra characters too.

OR just turn off javascript in your browser.

It's not secure, but it's clear that you can't have more than that.



About your specific point---
yes, you can paste into it.
if you type after that, though, it removes the excess... typing causes it to render.

I think one way to make it slightly better would be to add an "onBlur" command to the text field like this:
<textarea maxlength="40" onkeyup="return ismaxlength(this)" onBlur="return ismaxlength(this)"></textarea>

I think this is very much worth adding to the script, actually.

onBlur is the opposite of onFocus... meaning when you click out of the text box, it will check if its too long. So... there's no way to submit this with it being too long. Except turning off javascript.
Also... might work to do it if you clicked directly on the submit button from the textarea, but I think that would count as "blur".

[javascripter]

IE supports 'onPaste' event but other browsers don't. So I think onblur is good option.

[djr33]

I'd say go ahead and add onPaste as well, then... doesn't hurt.

the problem, though, is that this is a bunch for people who are using to script to add to each textarea... the idea is to be userfriendly.

I'm not incredibly well versed in JS.... is there a way to simplify the code?
Like this, or something:
onkeyup;onBlur;onPaste=""
???

[javascripter]

I used onPaste ="return false". I am not allowing user to paste anything.
<textarea name="txtMessage" onPaste="return false" onblur="validate()" >

function validate()
{
var msg,mainMsg;
msg="";mainMsg="";
msg=document.frmMessage.txtMessage.value;
mainMsg=msg.substring(0,10);
document.frmMessage.txtMessage.value=mainMsg;
}

wish we had something like textArea_changed

[djr33]

hmm... yeah.

onChange? Heh. Probly not though. That works for dropdowns, anyway.

On good idea you had, though, is to use "validate" as the function.

Why not just use a single letter... saves some space.

onblur="a()", etc etc. Heh.


Edit: onChange info:

http://www.devguru.com/Technologies/.../textarea.html

onChange Event handler
This event handler executes some specified JavaScript code on the occurrence of a change event (when the Textarea object loses focus and its value has altered).

Not exactly what is wanted, but maybe helpful. Slightly better than onBlur if nothing else.

[mwinter]

Hi , I have found bug in textarea maxlength code.

If you intend to limit entry lengths, do so in response to the change and submit events:

var maximumLength = 40;

function checkLength(control, maximum) {
  var length = control.value.length;

  if (length > maximum) {
    alert('Please limit your message to ' + maximumLength
        + ' characters. There are currently ' + length + '.');
    return false;
  }
  return true;
}

function validate(form) {
  var controls = form.elements;

  if (!checkLength(controls.textArea, maximumLength))
    return false;

  return true;
}

<form action="..." onsubmit="return validate(this);">
  <!-- ... -->
    <textarea ... onchange="checkLength(this, maximumLength);"></textarea>
  <!-- ... -->
</form>

Mike

[Twey]

This script is client-side validation; it's never going to be secure. There's no real point getting upset if someone can paste something into it and override the limits, because it's a simple matter to step around the validation anyway.

[djr33]

True, but it should be as secure as possible because someone might get around it, assuming that's ok, then send more "important" information that will just get chopped off serverside. Ouch. Heh.

[Twey]

Good point. Fair 'nuff.