Is there a limit to the length of HTML attributes?

Question

HTML 4

From an HTML 4 perspective, attributes are an SGML construct. Their limits are defined in the SGML Declaration of HTML 4:

         QUANTITY SGMLREF
                  ATTCNT   60      -- increased --
                  ATTSPLEN 65536   -- These are the largest values --
                  LITLEN   65536   -- permitted in the declaration --
                  NAMELEN  65536   -- Avoid fixed limits in actual --
                  PILEN    65536   -- implementations of HTML UA's --
                  TAGLVL   100
                  TAGLEN   65536
                  GRPGTCNT 150
                  GRPCNT   64

The value in question here is "ATTSPLEN" which would be the limit on an element's attribute specification list (which should be the total size of all attributes for that element). The note above mentions that fixed limits should be avoided, however, so it's likely that there is no real limit other than available memory in most implementations.

HTML 5

It would seem that HTML 5 has no limits on the length of attribute values.

As the spec says, "This version of HTML thus returns to a non-SGML basis."

Later on, when describing how to parse HTML 5, the following passage appears (emphasis added):

The algorithm described below places no limit on the depth of the DOM tree generated, or on the length of tag names, attribute names, attribute values, text nodes, etc. While implementors are encouraged to avoid arbitrary limits, it is recognized that practical concerns will likely force user agents to impose nesting depth constraints.

Therefore, (theoretically) there is no limit to the length/size of HTML 5 attributes.

I've just written a test (Note! see update below) which puts a string of length 10 million into an attribute and then retrieves it again, and it works fine (Firefox 3.5.2 & Internet Explorer 7)

50 million makes the browser hang with the "This script is taking a long time to complete" message.

Update: I've fixed the script: it previously set the innerHTML to a long string and now it's setting a data attribute. https://output.jsbin.com/wikulamuni It works for me with length 100 million. YMMV.

el.setAttribute('data-test', <<a really long string>>)

I really don't think there is any limit. I know now you can do

<a onclick=" //...insert 100KB of javascript code here">

and it works fine. Albeit a little unreadable.

From HTML5 syntax doc

9.1.2.3 Attributes

Attributes for an element are expressed inside the element's start tag.

Attributes have a name and a value. Attribute names must consist of one or more characters other than the space characters, U+0000 NULL, U+0022 QUOTATION MARK ("), U+0027 APOSTROPHE ('), U+003E GREATER-THAN SIGN (>), U+002F SOLIDUS (/), and U+003D EQUALS SIGN (=) characters, the control characters, and any characters that are not defined by Unicode. In the HTML syntax, attribute names may be written with any mix of lower- and uppercase letters that are an ASCII case-insensitive match for the attribute's name.

Attribute values are a mixture of text and character references, except with the additional restriction that the text cannot contain an ambiguous ampersand.

Attributes can be specified in four different ways:

1. Empty attribute syntax

2. Unquoted attribute value syntax

3. Single-quoted attribute value syntax

4. Double-quoted attribute value syntax

Here there hasn't mentioned a limit on the size of the attribute value. So I think there should be none.

You can also validate your document against the

HTML5 Validator(Highly Experimental)

I've never heard of any limit on the length of attributes.

In the HTML 4.01 specifications, in the section on Attributes there is nothing that mention any limitation on this.

Same in the HTML 4.01 DTD -- in fact, as far as I know, DTD don't allow you to specify a length to attributes.

If there is nothing about that in HTML 4, I don't imagine anything like that would appear for HTML 5 -- and I actually don't see any length limitation in the 9.1.2.3 Attributes section for HTML 5 either.

From http://dev.w3.org/html5/spec/Overview.html#embedding-custom-non-visible-data:

Every HTML element may have any number of custom data attributes specified, with any value.

That which is used to parse/process these data-* attribute values will have limitations.

Turns out the data-attributes and values are placed in a DOMStringMap object. This has no inherent limits.

From http://dev.w3.org/html5/spec/Overview.html#domstringmap:

Note: The DOMStringMap interface definition here is only intended for JavaScript environments. Other language bindings will need to define how DOMStringMap is to be implemented for those languages

DOMStringMap is an interface with a getter, setter, greator and deleter. The setter has two parameters of type DOMString, name and value. The value is of type DOMString that is is mapped directly to a JavaScript String.

From http://bytes.com/topic/javascript/answers/92088-max-allowed-length-javascript-string:

The maximum length of a JavaScript String is implementation specific.

[ note: chrome is reporting bytes.com as a source of malware so, beware ]