title: Mystery .x and .y form fields - where do these come from?
body: <p>Take a look at <a href="https://www.drlaura.com/site/member/login/" rel="nofollow">this login page</a>, specifically, the form in the section labeled Returning Members. As you can verify by looking at the HTML or by digging with a tool such as Firebug, the actual form contains four  tags: one each for the email address and password, an invisible input called "memberAlready" that contains the value "yes", and a submit button in the form an image. So far, perfectly generic.</p>
  
  <p>However, if you inspect the form data at the point at which the form is submitted (using <a href="https://addons.mozilla.org/en-US/firefox/addon/tamper-data/" rel="nofollow">Tamper Data</a> or its equivalent on another browser, you'll see that two additional form fields have been sneaked into the response: ACTION(loginCheckout).x and ACTION(loginCheckout).y. </p>
  
  <p>They both have two-digit integer values, which suggests that they're only there to verify that the submitter is an actual web browser and not a robot. Presumably, they are related somehow to the submit button, which is defined as follows:</p>
  
  <pre><code>&lt;input type="image" name="ACTION(loginCheckout)" value="Login" src="/images/login/login.gif"&gt;
  </code></pre>
  
  <p>What's confusing to me is that these extra form fields appear <strong>even when JavaScript is disabled in the browser</strong>. So they presumably aren't just something inserted by an event handler somewhere. </p>
  
  <p>Furthermore, if you submit the form programmatically (e.g., by running document.forms[1].submit() in the JavaScript console), the extra fields <strong>are not</strong> generated and the login attempt fails. That suggests to me that the insertion of the fields depends on something outside the basic HTML form submission mechanism. But what that "thing" could be if it's not JavaScript, I don't know.</p>
  
  <p>Does anyone recognize this pattern or have a theory as to how the validation fields are inserted?</p>