Comment by gnabgib | Hacker News Reader

Comment by gnabgib | Hacker News Reader

This seems a bit discombobulated. You shouldn't be using a `<button>` at all but a `<input type=submit ..` for most of the examples. The search example shouldn't be changing it's name (query->q) for new practitioners following along, and should be using `<input type=search`.

In the `too-short-message` example where is the `not-long-enough` message defined?

Then we run off into microformats, they're great, but out of scope (and never tied back).

The button extension using custom attributes should be getting attribute `message` (not `type`).. but that's probably a typo. A potentially more reasonable attribute would be `title` since in many desktop browsers you'll get a hover tooltip (which might be beneficial, although for the contrived example perhaps not.. on the other hand, why would you want a multitude of alert buttons?)

And then there's zero consideration for Content-Security-Policy[0], one of the current reasons you'd avoid inline JS (`unsafe-inline`) in favour of script tags that can have `nonce-*` or `sha256-*` signed content.

[0]: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP

<input type="submit" value="Search"> is fine and is the most common solution. But <button>Search</button> is also completely fine, and if you want anything other than plain text as a button label (e.g. images, variable formatting), it’s the approach you have to use. (When used in a form, there’s an implied type="submit" on it. With type="button" it would lose the submitting functionality and become obviously unsuitable.)

Fixed the "message" and "query" typos, thank you! I iterated on those examples a bit and didn't get them all back into line.

As for CSP, my point isn't really that you should be throwing `onclick`s on everything, it's more that you should think of HTML as the place to define most of the page's behavior (where appropriate) using elements and attributes. A script tag could implement that interface too.

The best way to deal with CSP is to never allow a CSP directive in your HTML or response headers. It's one of the worst, most confused, harmful specifications in the collection of modern Web standards. At the very least, anyone who isn't on the security team at an org should be forbidden from touching anything related to CSP. (If the org isn't big or organized enough to have a security team, that would be a set of size 0. Seriously, don't use it.)

`<button type=submit>` makes more sense to me than `<input type=submit>`

Reply on news.ycombinator.com