Hi Simon, Just tried it and yes, it happens with a simple h:inputText instead of the tr:inputText, too.
Felix -----Original Message----- From: Simon Kitching [mailto:[EMAIL PROTECTED] Sent: Wednesday, September 17, 2008 4:41 PM To: MyFaces Discussion Subject: Re: wrong/missing validation behaviour - security problem. Does this happen if you use an h:inputText rather than a tr:inputText?