Search code examples
phphtmlformsfirefoxhidden-field

Why is Firefox removing / ignoring hidden input values from an HTML form?

I have an HTML form that uses hidden inputs to manage behavior in the PHP processing script.

In browser testing I found that the form works perfectly in Chrome and IE, but there's a problem with Firefox.

The Firefox browser (using 39.0) removes hidden input values. They just completely disappear leaving only value="". This in turn messes up my PHP.

I've searched high and wide for information about this issue but have found nothing.

Why is Firefox removing (or ignoring) hidden input values in my HTML form?

In Original File enter image description here

In Chrome Developer Tools enter image description here

In Firefox Inspector enter image description here

UPDATE (based on comments posted)

Browser Tests. The form has been tested across all major browser both desktop and mobile versions. The form works perfectly across all browsers (including Firefox mobile), but fails to fully function in Firefox desktop (39.0) because the hidden input values are removed.

UPDATE 2

Re-starting and re-installing Firefox has failed to fix the problem.

UPDATE 3

Have removed all client side scripting and checked HTML validation (no errors). Problem persists.

UPDATE 4

This seems to be an issue related to the way Firefox caches data and handles POST requests.

When I "Clear All History" (including cookies, cache, etc.) the form works as intended... ONCE.

In all subsequent submissions the value attribute has an empty value, and no data is passed to PHP, until I "Clear All History" again.

This doesn't happen in other browsers.

Solution

  • I had exactly the same issue. No client side script used. I nested the hidden field in a div and then all worked.

    This worked: 

    <div>
<input type="hidden" value="<?=($_SESSION['CSRF-TOKEN'] ?? 'token')?>"name="_token">
</div>

    This replicated exact behavior described in post: 

    <input type="hidden" value="<?=($_SESSION['CSRF-TOKEN'] ?? 'token')?>"name="_token">

    Either variant above worked on Chrome. Issue only appeared on desktop Firefox 63.0.1 (64-bit).

    Update (2018-11-15) Actually in my case the issue was that the HTML was malformed (there was no space before the name attribute). It appears that Chrome was tolerant of this and Firefox less so. Firefox submitted the value once and then not again unless cache was cleared. Correcting the HTML corrected this quirky behavior experienced with Firefox. Corrected HTML:

    <input type="hidden" value="<?=($_SESSION['CSRF-TOKEN'] ?? 'token')?>" name="_token">