4

One of my pages was scanned by Checkmarx and it's returning this flag "Multiple Forms In Visualforce Page"

Indeed in my page I have several form tags like so:

<apex:outputPanel rendered="{! $CurrentPage.parameters.show_custom_1 == '1'}">
    <apex:form >
        <apex:commandButton value="Custom Action 1" action="{!customAction1}"/>
    </apex:form>
</apex:outputPanel>



<apex:form >
    <apex:inputText value="{!customText1}"/><br />
    <apex:commandButton value="Update customText1" action="{!updateCustomText1}"/>
</apex:form>

One other interesting thing to note is one of these forms is conditional and may or may not appear.

But regardless, it doesn't seem like it should matter? Why is it a problem to have more than one form on a page? That's a very common thing in a modern webpage. I've seen some pages that have 10 forms or more, as long as they are contained to their own area and don't overlap, I don't see why it's a problem?

Improve this question
3
  • 1
    I made an assumption that ages ago salesforce didnt work as expected with multiple forms on pages, and that scanner issue may be legacy. I have seen some over release notes that those were fixed in salesforce, but still trying to avoid using multiple forms on page. "Just in case..."
    – kurunve
    Jul 22, 2016 at 15:10
  • Will this prevent me from passing security review?
    – user1813867
    Jul 22, 2016 at 15:27
  • @user1813867 Does it affect the security review?
    – Madhavi Bhattad
    Oct 18, 2019 at 5:13

1 Answer 1

Reset to default
5

First of all, see this blog post, which claims second hand:

multiple forms cause multiple instances of viewstate on your page, which makes you much more likely to hit the viewstate limit.

I'll see if I can verify that claim. Also note this quote from the documentation on <apex:form>:

It's a best practice to use only one <apex:form> tag in a page or custom component.

You don't need to wrap each button with a form, they just need to be inside one at some level.

Multiple Forms

<apex:repeat ...>
    <apex:form><apex:commandButton ... /></apex:form>
</apex:repeat>

One Form

<apex:form>
    <apex:repeat ...>
        <apex:commandButton ... />
    </apex:repeat>
</apex:form>
Improve this answer
3
  • I could probably fix this if I could find another way to use a command button without the requirement of the form. Do you know of an alternate way to have a button kick off a controller action? Currently I'm doing this: <apex:form > <apex:commandButton value="customAction" action="{!customAction}"/> </apex:form>
    – user1813867
    Jul 22, 2016 at 15:43
  • 1
    Adrian's point is asking why do you need multiple forms. Why is it not possible to have just one form tag at the beginning and end of the page?
    – Sebastian Kessel
    Jul 22, 2016 at 17:10
  • @Adrain Does having multiple form in the VF page affects the security review?
    – Madhavi Bhattad
    Oct 18, 2019 at 5:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .