Why is the `NAME` attribute considered unsafe?

Question

I'm passing user-generated HTML into a database and I'm trying to make sure that no malicious code is passed through. One of the steps I'm taking is to run passed code through pear's HTML_Safe class to remove vulnerable markup. However, one thing I've noticed is that the name attribute of submitted elements gets removed. Sure enough, when you look at the source code, name is one of the few attributes that's blacklisted by default:

http://pear.php.net/package/HTML_Safe/docs/latest/HTML_Safe/HTML_Safe.html#var$attributes

What's the danger in allowing users to pass values for name ? How can values for name be used to nefarious ends? Any thoughts? If not, I'm tempted to modify the blacklist.

Answer 1

In HTML form elements, the name attribute is used as an identifier. Therefore, if you allow name then someone may be able to override your HTML name attributes (that you may have used) with one of their own. The first matching name found is often the one used by either Javascript or server side processing.

This would then allow someone to exploit any possible Javascript or server side form processing you may be using that references the first matching name attribute found.

It is not just form elements that can use name , but they would be the least safe ones.

Another override issue is if you are using Javascripts getElementsByName in any of your functions (as pointed out below), you could end up with a function that does not do what you expect.

Edit: Some corrections and a note about getElementsByName issue (as pointed out below).