Learn the HTML embed element: what it was built for, how src, type, width and height work, why it has no fallback content, how it compares with object, iframe and img, accessibility and security limits, and when to choose something else, with live demos.
Start learning HTML embedded content: iframe, embed, object, SVG, canvas, and maps. See what each element is for, how they differ, how to choose between them, and why third-party content needs security care, with a live sampler of four embedding methods.
Learn the HTML form action attribute: where a form sends its data, absolute and relative URLs, what happens when action is left out, the GET query string trap, formaction on buttons, the target attribute, third-party form services, mailto actions, progressive enhancement with fetch, and security notes on HTTPS, CSRF, and the Content-Security-Policy form-action rule.
Learn the HTML form method attribute: how GET puts data in the URL and POST sends it in the request body, when to use each one, URL encoding, the post-redirect-get pattern, method dialog, why HTML forms cannot send PUT or DELETE, CSRF and privacy notes, and how to choose the safe method for search, login, and checkout forms.
Learn the HTML iframe element: embedding another page with src and srcdoc, titles for accessibility, size and aspect-ratio, lazy loading, the sandbox attribute, allow and referrerpolicy, why some sites refuse to be framed, and talking to a frame with postMessage, with live demos.
Learn the HTML input type file: uploading one or many files, the accept, multiple, capture, and required attributes, why a form needs method=post and enctype=multipart/form-data, reading file name, size, and type with JavaScript, image previews, size checks, styling the button, and safe server-side handling on CodeHarborHub.
Learn the HTML input type hidden: sending values the visitor does not see, such as record ids, CSRF tokens, return pages, and multi-step state. Understand why hidden is not secret, why the server must never trust it, how it differs from the hidden attribute, disabled, and readonly, and common mistakes on CodeHarborHub.
Learn the HTML input type password: how it masks characters, what it does not protect, the autocomplete values current-password and new-password, a show-password toggle that is accessible, minlength and pattern rules, password managers, HTTPS, and common security mistakes on CodeHarborHub.
Learn the HTML input type url for web addresses: what counts as a valid URL, why a scheme like https:// is required, restricting to http and https with pattern, autocomplete, trimming, the javascript: danger, safe ways to display user links, and common mistakes on CodeHarborHub.
Learn how to keep HTML links safe. Understand reverse tabnabbing, rel noopener and noreferrer, referrer policy, dangerous javascript and data URLs, user-submitted links, look-alike addresses, HTTPS, and how to protect your visitors on CodeHarborHub.
Learn the HTML form enctype attribute: application/x-www-form-urlencoded, multipart/form-data, and text/plain, why file uploads need multipart, what a multipart request body looks like, using FormData with fetch without setting the Content-Type, formenctype on buttons, and safe server-side handling of uploaded files, size limits, and filenames.
Learn secure HTML form design: never trusting the browser, server-side validation with allow-lists, HTTPS, escaping output to stop XSS, parameterised queries against SQL injection, CSRF tokens and SameSite cookies, safe password handling, rate limiting and bot defences, avoiding information leaks, safe file uploads, mass assignment, privacy and data minimisation, and a practical security checklist.
Learn the HTML base element: how it changes the starting address of every relative link, image and form, how it affects fragment links like #top, how base target works, why it is risky, and what to use instead. Includes a live URL resolver and a base tag checker.
Learn the HTML script element: inline and external scripts, defer, async and type module, where to place scripts, data blocks like JSON-LD, noscript fallbacks, and how to load JavaScript safely. Includes a live loading-order experiment, a script tag checker, and a JSON data block demo.
Learn how to keep a page safe when it embeds content you did not write: the risks of scripts, iframes and widgets, Content-Security-Policy, Subresource Integrity, iframe sandbox, Permissions-Policy, referrer and link rules, consent and privacy, click-to-load, auditing, and incident planning, with live demos.