Input type "hidden" vs text area

Question

Hi,

I'm having a weird issue with an input type hidden and was wondering if anyone has ever seen something like this before. I'm saving about 2MB of data to a hidden field, in a comma separated format, then I'm posting that data to a jsp that simply sets some headers (so the output is recognized as an excel file) and then echoes the data.

I'm seeing that the variable that holds this data gets empty to the jsp side, even though I see that it's getting posted to the server (I'm seeing it with an HTTP sniffer) and all data seems to be contained correctly in the hidden field (I'm seeing that with firebug). However, if I change the object type to be a text area, the data is received correctly on the server's side.

Another weird thing I'm observing is that if I use URL encoding on the data, even using a text area, nothing gets to the server. If I don't use URL encoding but I have the hidden field, nothing gets saved to the field (it's empty when I check it with firebug). I don't understand that either...

I'm wondering if there is any special security setting that prevents the hidden fields to post big amounts of data to a Tomcat web server. Does anybody know anything about that?

If it makes any difference, I'm using the default enctype on the form (application/x-www-form-urlencoded)

I'm currently using a text are and setting the style to visibility "hidden" but it bothers me not to understand what's going on *sigh... Any suggestion is appreciated

Answer 1

I think having 2MB of data in a hidden field is a mistake regardless. You should store that kind of thing on the server as part of the session state, not send it back and forth between the server and the user, as you are doing. Instead, use a hidden field or cookie for the session variable*, which will be used to look up the 2MB of data.

*Don't do this by hand. JSP already has support for session state, among other things.

Answer 2

The server can't tell the difference between a textarea and textbox. All form elements are simply posted as name/value pairs.

Most likely, you have a double-quote somewhere in your data that's terminating the value attribute of the hidden input element. For example:

<input type="hidden" value="Double " quote" />

You need to escape the double-quotes by replacing them with "

<input type="hidden" value="Double &quot; quote" />