Search inserts hidden input element which breaks XHTML1.1

That’s your theme – not WP.
The “default” is XHTML 1.0 and there is no phpsessid in the default.

I apologize, I misspoke. The theme is mine, a minor modification, and I never changed the searchbox manually.

Perhaps a better explaination of my problem is this:
I’m trying for XHTML 1.1 compliance, and the only thing holding me up is the searchbox. I can’t reproduce it looking at the output myself, but the validator shows up the problem, using my own theme or the default.
https://validator.w3.org/check?uri=http%3A%2F%2Flog.davedot.com%2F&charset=%28detect+automatically%29&doctype=Inline&ss=1

Maybe I wasn’t clear.
In the “default” theme there is no code like this:
name="PHPSESSID" – it has name="s".
Furthermore, the out-of-the-box WP has XHTML 1.0 doctype, not 1.1.

That’s why I said it is your theme. And no clue how to fix it.

The hidden input is due to PHP being configured to run with sessions. You can find out about it here:

https://php.net/session

If you have access to the php.ini or your host can *switch it off*, you’re looking for the session.use_trans_sid setting. If you (or your host) have reasons for running sessions, then some way would have to be found to place the inputs in <div> elements to make them valid.

My searchform.php looks like this:
<form method="get" id="searchform" action="<?php echo $_SERVER['PHP_SELF']; ?>">
<div>
<input type="text" value="<?php echo wp_specialchars($s, 1); ?>" name="s" id="s" />
<input type="submit" id="searchsubmit" name="Submit" value="Go" />
</div>
</form>

but the <input type="hidden" name="PHPSESSID" value="[random string]" /> gets put in at some point during processing, so the output looks like this:

<form method="get" id="searchform" action="/index.php"><input type="hidden" name="PHPSESSID" value="[random string]" />
<div>
<input type="text" value="" name="s" id="s" />
<input type="submit" id="searchsubmit" name="Submit" value="Go" />
</div>
</form>

Putting <div> outside the form does no good, and I don’t have access to php.ini. I even tried php_value session.use_trans_sid 0 in .htaccess, but no luck there. I guess I’ll have to live with very near 1.1 compliance.

It doesn’t actually fix the problem, but by hiding the search box from the validator it checks out. I know my code is good, I just can’t find a way to kill sessions.