HTML needs a “clickonce” attribute

I know you can do it with Javascript or style sheets and stuff. But it’s really a fundamental. HTML <button> and <submit> objects need a ‘clickonce’ attribute which disables the button as soon as the user clicks on it so that websites can real easily make it so that you can’t submit forms multiple times under heavy load/slow connecvity issues. If nothing else, it would provide a final catch for all the ways in which you’re supposed to be able to do it and butt-covering for those cases where a dev fails to make disabling the button the very first order of business.

Time to dig up my W3C contacts, I think.

6 Comments

Why is that an HTML spec issue? That’s a browser flaw. Why is the browser allowing the user to make multiple POST requests on form submissions? Why isn’t it waiting for a response before allowing the user to initiate another request? Security obviously isn’t your concern in this case so put the blame where it belongs – with the browser.

Besides, as you’ve already noted there are plenty of band-aids already available. We sure don’t need more of them.

Because the HTML standard doesn’t specify that a button can only be clicked once, and there are debatable reasons as to why it might be allowed – if you’re wandering into the land of scripting then the browser has no way to know whether or not you are doing some asynchronous Ajax functionality in which it is perfectly acceptable for multiple clicks.

That’s why every browser has the same problem, because nobody has specified the behavior.

Besides, those bandaids all have significant requirements and security considerations – specifically you have to allow a browser use scripting.

IMHO, its a markup issue and it makes most sense as a browser markup. <submit type=’submit’ name=’complete’ value=’Charge me $50′ final=’true’/>

I understand the thought behind your argument but I don’t think it’s the answer.

– Whether the button has been clicked or not is a matter of handling the state of form elements on submission by the user agent and – if security is not a concern – it can be handled perfectly well with Javascript. The applicable tags already have events and an attribute to handle exactly that.

– If you’re using AJAX then you’re using xmlhttprequest and generated the request using Javascript, thus allowing you to handle the state of the button through scripting.

– If security were any concern you wouldn’t allow any of this to be handled on the client. ;-P

So if you take away the use of scripting to prevent a user from making multiple POST requests to your server using their nifty button on your web page we’re left with one very simple way to prevent them from inadvertently making multiple requests via the browser – wait for the server’s response! When the user agent makes a POST request when submitting a form, disable all controls pertaining to that form element until a response is received OR the user cancels the request.

Now with all that said, I’m sure they’d be happy to throw it on into the WebForms2/3 and HTML5 specs. They seem quite happy to spec out a tag or attribute for anything these days. But I still say the real issue in my mind is how the spec says user agents should handle the submission of forms rather than a need for an attribute.

btw, if it wasn’t clear I am conceding it to be an HTML spec issue. I’d just rather the clarification in how form submission is handled by the agent rather than adding another attribute.

It seems to me to be a bit like the box model problems – is it a matter of more attributes or how the existing tags and attributes are handled?

Leave a Reply

Name and email address are required. Your email address will not be published.

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

You may use these HTML tags and attributes:

<a href="" title="" rel=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <pre> <q cite=""> <s> <strike> <strong> 

%d bloggers like this: