Serialize will submit disabled select options

[danielnashnz]

If you have a selected option from an HTML form select dropdown that is _disabled_ (i.e. by the option having disabled="disabled" attribute), the $.serialize() method will still encode its value. According to the HTML 4.01 spec a disabled field can never be 'successful' (that is have it's value sent). Ref:  http://www.w3.org/TR/html401/interact/forms.html#successful-controls

e.g. from this HTML form block, only the value "mA" should succeed, but serialize also serializes "mC"

<select id="03_multi_select_option_disabled" name="03_multi_select_option_disabled" multiple="multiple" size="4">
  <option selected="selected" value="mA">multiselect A</option>
  <option value="mB">multiselect B</option>
  <option selected="selected" value="mC_disabled" disabled="true">multiselect C disabled</option>
  <option value="mD">multiselect D</option>
</select>

[flesler]

jQuery does respect this, only elements with name and not disabled are submitted. But you can't disable options, just selects. Also... to disable an element, the correct way is setting disable="disable" not "true".

Try making a regular html form with method equal to GET and submitting it. You'll see that the options are submitted even if disabled.

(actually tried this myself to be sure).

[danielnashnz]

I dispute "you can't disable options, just selects" - the HTML 4.0.1 Spec states in section 17.12.1:

The following elements support the disabled attribute: BUTTON, INPUT, OPTGROUP, OPTION, SELECT, and TEXTAREA.

And indeed Firefox3 will show the option as greyed out and unselectable. However if you preselect it or select it via script it becomes selected and is then included ERRONEOUSLY by serialize for the reason first stated.

[nathanhammond]

Test Case

[nathanhammon]

Upon reviewing the spec and FF3's implementation, I agree with danielnashnz. I've attached my test case. I'll come up with a patch to jQuery.fn.serialize() tomorrow.

[nathanhammon]

Actually, the patch will be to jQuery.fn.val in core.

[nathanhammond]

Patch

[nathanhammon]

And I lied about tomorrow. I've attached a patch that makes this fix. We should probably create a test for this in the test suite (I don't know how, I'm new to this project).

[flesler]

Ok we'll see.

[nathanhammond]

Patch. Includes patch to test as well.

[nathanhammond]

Patch. Includes updates to Test Suite.

[nathanhammon]

I severely screwed up on the first one. Too quick to pull the trigger. The new version includes the completely modified test suite to account for changes I wanted to make for testing purposes. I've also set up the test suite to easily be adapted to include a test for the following question I didn't address:

Should $('#form option:selected') return selected options that wouldn't be successful? The case when that would happen is when either the option, parent optgroup, or parent select are disabled.

[dmethvin]

This got lost, but the patch still seems good.

[dmethvin]

Patch:  http://github.com/dmethvin/jquery/commit/3597045367f02be3108d09fd922e27cb5c744567

I didn't change the result of .val() on a disabled select, my thinking there was that .serialize() already excludes those but if someone explicitly calls .val() on a disabled select they want to know what the value would be if it were not disabled.

[john]

Fixed  http://github.com/jquery/jquery/commit/2c4b20809e5d32e916c479c9b63a6b7528c880ce