Multimedia: Video, Audio, and Embedded Media - HTML5 Mastery: Semantics, Standards, and Styling - page 195

Let's get into object 's attributes. The data attribute is like the src attribute on
the img or embed element; it just specifies the location of the resource to load. The
type attribute works like it does on the embed element; give it a valid MIME type for
the resource being embedded. One or the other of the data or type attribute must be
present, but they both don't need to be. If both are present, the Boolean typemust-
match attribute may be added, which adds a layer of security when loading the re-
source. For example, it's possible to use the object to embed media and other re-
sources from third-party websites, 4 which presents a security issue if the third-party site
says they are delivering a resource of one type, when in fact it is a malicious script, or
similar, disguised as something harmless. The browser will content sniff the linked re-
source when the typemustmatch is set and won't embed the resource if its content
type differs from the value set in the type attribute.
One aspect of the object element that may be a surprise is that object is meant to
be able to take part in form submission and submit data along with a form. This isn't new
in HTML5 either because it was included in the HTML 4.01 specification, which listed
“object controls” 5 as one of the types of form controls. The new addition of the form
attribute is just to make object consistent with other form controls. If you recall from
the previous chapter, the various form controls ( input , textarea , and so on) use the
form attribute to associate themselves with one or more forms, even if they aren't nes-
ted inside the one they are referencing. This attribute works the same for object . The
idea of including an object as part of a form addresses the need to have some plug-ins
send data directly to a server. For example, a plug-in might be created that embedded
a complex in-browser word processor of some sort, which had features that were bey-
ond what was possible with HTML/CSS/JavaScript. The word processor could then be
used in place of a plain old textarea , but at form submission time the word processor
could submit data to the server directly from the plug-in (perhaps including all kinds of
metadata about how the text was fancily formatted).
Typically when embedding a plug-in resource, the object element will need custom
parameters to be sent to the plug-in; what these will be will differ from plug-in to plug-
in. As mentioned earlier, the embed element addresses this with an unusual (and argu-
ably messy!) solution of allowing any additional attributes added to the element, which
then get handed off to the plug-in. object takes a different (and arguably cleaner) ap-
proach. Instead of allowing arbitrary additional attributes to be added, object utilizes
another element, param , which is placed inside the opening and closing tags of ob-
ject and can be used to pass values on to embedded plug-in. param has two attributes
(in addition to the global attributes): name and value . When nested inside the ob-
ject element, the value specified in the name and value attributes are passed on as