# Fill out Forms

When visiting web sites you'll often need to fill out forms where you have to enter similar data like your name, email addresses, passwords etc. iCab provides different ways to help filling out web forms so you don't have to enter the same values over and over again. You can save the current values of web forms and fill out the form later again using these saved values. iCab can also fill out certain form field without the need to have saved the forms before. It is even possible that iCab autocompletes your input while you enter text.

All these form fill out features can be configured in the Forms Manager that can be opened from within the Tools menu.

iCab saves all the form data in the Keychain application of the MacOS. So all the data is saved secure and encrypted. But you have to allow the keychain application to store and retrieve the form data. Especially when an iCab update is installed, the keychain application will ask the user if the new version of iCab is allowed to access the form data which was saved by the old version of iCab. This is normal behaviour which makes sure that no new application is able to access sensible data without the permission of the user.

## Forms Manager

In the Forms Manager (menu item "Tools > Forms Manager") you'll find three Tabs. Each of these Tabs contains the settings for a different way to help filling out forms:

Input fields
  Here you can configure the field-based form fill feature. You can add any number of words and phrases in the list. When you start entering some text in an input field in web forms, iCab will look for words and phrases in this list which start with the same letters you have just entered. If iCab found a matching item, it will automatically complete your input with the found text. So usually you only have to enter two or three letters in an input field and the rest can be filled out by iCab.

  This feature is very useful for all the information you have to enter in many web forms (like email addresses, your name, address, telephone number etc.)

  This feature can be used for all forms, even in forms which were never visited before.

All Forms
  Here you can configure the autocomplete feature which is based on the names of form fields. In most forms the input field where you have to enter your name is named "name" internally. So iCab could check if a form contains a field with the name "name" and automatically fills in your name here. This autocomplete feature will work on all forms, even forms you've never visited before. To fill out forms with this data, select the menu item "View > Fill out forms". This feature is useful for all information you would open on many web pages (like name, address, email address, etc) but not for data you would only enter in one web page (like passwords).

  When selecting the menu item "View > Fill out forms" iCab will check if the forms of the web page has input field whose name is included in the list of form data. When iCab finds a form field with a matching name if fills out the value that is defined for this name in the input field.

  The list of form data has two columns: the Name of the field and the value. The "field name" column can contain a comma separated list of names which represent the (internal) names of input fields. Because the field name is not always the same on all web pages (for example one web page may use the name "city" and another the name "town" for an input field where you should enter the town in which you live), just provide a comma-separated list of names which have the similar meaning. This makes it more likely that a name can be found which is really used on the web site. The "value" column contains the text that should be filled into the form field.

  Example:

  Name of Field | Value
  --- | ---
  city,town | New York
  country | USA
  email,mail | my.name@mydomain.invalid
  address,street | Park Avenue 123

  Please note that even if the web page itself is in German or French or in another non-English language, the internal names are often nevertheless in English. So you should always add english names in the name lists as well.

Special Web Sites
  This autocompletion feature is used to save the current state of web forms of a web page and to restore the form later when you visit the page again. You have to save a form first after filling it out manually (using the menu item "View > Save Forms"), then you can let iCab fill out the form for your when you visit the page again (using the menu item "View > Fill out forms" or clicking the "Fill out forms" button in the toolbar or even automatically when entering the web page).

  If you enable the option "Automatically fill out forms when entering a web page" iCab will automatically fill out the forms of a web page after the page is loaded, so you don't need to select the menu item to fill out the form manually.

  For security reasons iCab will save all the internal form data when you save a form. And when filling out a form, iCab will check all the internal form data to make sure that the saved form data is really filled out in the correct form on the correct web page. Other browsers do not check the forms that strict (usually they only check if the domain name of the web page is the same), and because of this there are many security issues in these browsers: passwords can be stolen using the auto form fill feature when criminals are able to add a (invisible) "fake" form somewhere on a web site on which you would enter some login data to get to your personalized area of this site. The strict checks of iCab will prevent that iCab would reveal sensible data to such "fake" forms.

  Unfortunately there are web pages where some internal (invisible) form fields are different each time the web page is visited. Usually these differences are because of a "Session ID", an internal form value that is unique and which is used to prevent that a form can be submitted multiple times. But because the Session ID is different each time the web page is opened, iCab will never be able to identify the form as the one that was saved before and so filling out the form automatically will fail. "Fake" forms from criminals will also be different to the original form, and it is not possible to recognize automatically if a form is different because of a Session ID or because of some criminals who try to steal your passwords. Which is probably the reason why other browser do not check the forms and prefer the comfort over the security.

  In iCab you have several choices to solve this problem. You can either remove some of the form checks, which increases the security risk like in other browsers, or you can edit the saved form data to give iCab a hint where the Session ID is located so that iCab knows what it can ignore in the form checks.

  To edit the saved form data, double-click the entry of the web page in the URL list. A dialog box will open with a list of all forms and form fields with their name and value. The value can be modified. To let iCab accept any value for a certain field, you can replace the text of the value field by the character "*" ("*" is a wildcard character which stands for any number of letters). You can also replace only a certain part of the text of a value field by a "*" if only this part will be different each time the page is loaded. When editing the form data the user may need some experience, but it is a good way to be able to fill out forms reliable without any security issues.

  If you don't have such experience you can still configure iCab to be less strict when checking the forms. Then filling out forms automatically will be much more reliable, but then there are some security issues (like in other browsers). As long as iCab is doing some form checks, there are less security issues than in other browser.