The textarea element

Definition

textarea collects multi-line plain text. Its current value participates in form submission under the control's name. It is not a rich-text editor and does not interpret user-entered HTML when handled safely as text.

Minimal syntax

<label for="message">How can we help?</label>
<p id="message-help">Do not include passwords or payment information.</p>
<textarea
  id="message"
  name="message"
  rows="8"
  maxlength="2000"
  aria-describedby="message-help"
  required
></textarea>

Initial content belongs between the tags, not in a value attribute. In an application, restore the controlled value without inserting it as executable markup.

Sizing and limits

rows and cols provide initial dimensions; responsive CSS can set width while allowing vertical resizing. maxlength supplies a client limit, but the server must enforce byte and character limits appropriate to storage and downstream services.

Accessibility

Keep the label and instructions visible. If a character counter is useful, avoid announcing every keystroke; announce only meaningful thresholds or errors. Preserve safe text after validation failure, keep the resize handle when possible, and ensure the control remains usable at high zoom.

Security and privacy

Treat submitted text as untrusted. Validate length and allowed context, encode it on output, and avoid placing it in analytics or broad logs. State what not to include before the control. Do not claim a message was delivered until the authoritative endpoint confirms success.

Common failures

• Reading from a nonexistent value attribute.
• Converting submitted text into raw HTML.
• Clearing a long message after an unrelated error.
• Using a fixed height that clips enlarged text.
• Logging message content when only an outcome code is needed.

Verification checklist

Paste multi-line, long, Unicode, empty, and adversarial text. Inspect the request and server limit, then verify output is encoded and safe values survive rejection. Test label and description exposure, keyboard selection, resize, spellcheck expectations, 200% zoom, 320-pixel reflow, and slow or failed submission recovery.

Maintenance note

Review length limits, prohibited content guidance, retention, and downstream encoding whenever the message workflow changes. The control's visible size is not a reliable statement of accepted or stored capacity.