Web Applications - Refactoring HTML: Improving the Design of Existing Web Applications - page 271

The browser may present this as a slider, scroll bar, or some other kind of input control that does not provide
precise control rather than making the user type a value in a text field.
url
The url type requests an absolute IRI (like a URL, except that it can contain non-ASCII letters such as é) from
the user, such as http://www.elharo.com/blog/ or ftp://ftp.ibiblio.org/.
Browser Support
Not all browsers support these types. In fact, currently only Opera 9 does. However, Firefox and Safari are likely
to in the future and others may follow. However, if they don't, much of this can be supplied with JavaScript and
AJAX. Google has released a JavaScript library to add support for these types (and other Web Forms 2.0
features) and functions to your web pages in legacy browsers such as Firefox 2 and Internet Explorer 5. Simply
copy the JavaScript library from http://code.google.com/p/webforms2/ to your site and add this script
element to the head of your document:
<script type='text/javascript' src='webforms2.js'></script>
Even if that's not an option, Web Forms 2.0 has been carefully designed to degrade gracefully in legacy
browsers. Visitors with older browsers will simply see normal input fields when they reach a page using these
new types. They'll have to wait for the server to tell them if they've input a bad value, rather than being told
before they submit. It's no worse than the status quo.
Data Validation
It's important to remember that client-side validation in no way guarantees anything about the data the server
receives. Always validate any input received from a client. Some browsers do not support these types at all and
will allow users to submit any data they choose. Crackers can and do submit deliberately invalid data to attempt
to penetrate systems, deface web pages, steal passwords, and otherwise do naughty things. Always verify the
input you receive from the client on the server, regardless of these types or any other client-side validation
logic.