Q:

any legitimate way to bypass maxlength on HTML text field?

I saw an entry in our web app's exception log which seems to indicate that a user somehow submitted a web form in which an <input type="text" ...> was filled in with more characters than was specified in the maxlength attribute for the field.  The only result of this was generating a SQL exception to the log and presenting a generic error page to the user (i.e. the user did not see the SQL error), so no damage was done.  But I am curious as to how this happened.
I know there are "hacking" ways to circumvent this (submitting through a custom client, munging the HTML with Firebug, etc) but are there any legitimate ways that this can happen (perhaps using a certain browser), that I can address through a code change?
Just to be clear... if it was generated through hacking, no change is needed... the SQL error protects the system from harm.  However if a user legitimately hit this somehow, I'd like to fix it.
In case it matters... the User Agent on that request was Safari / Mac (Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_5; en-us) AppleWebKit/533.19.4 (KHTML, like Gecko) Version/5.0.3 Safari/533.19.4)  I could not reproduce the issue on Windows Safari and I don't have access to a Mac.

A:

Possibilities include:

Some web browser (I don't know any off the top of my head) doesn't honor maxlength
A Greasemonkey-like script
Someone built another page, or even an application that submits to the location as your form

Remember, the browser string sent as part of the request is so easily forged that it's not even worth trusting it for anything other than basic analytics.
In general you need to be validating EVERYTHING that comes across the wire, preventing any bad data from making it into your system's internals (i.e. database). The HTML input field maxlength attribute and any other client-side validation is there for the convenience of your users, but will not in any way protect your site. Plus if you perform your own validation you can return nicer error messages to your users. And down the road, it will also help you in debugging your own application when something goes wrong.
In my opinion, any user-submitted data that causes a database error to be generated is a serious defect and probably indicates a security hole in the system.

