The form Element
The <form> element wraps all the controls (inputs, buttons, selects) that belong to a single form. It tells the browser where to send the data and how to send it when the user submits.
<form action="/submit" method="POST">
<!-- form controls go here -->
</form>
The two most important attributes on <form> are action and method.
The action Attribute
The action attribute specifies the URL the form data is sent to when the user submits. It can be an absolute or relative URL.
<!-- Relative URL β sends to same origin -->
<form action="/contact/send">β¦</form>
<!-- Absolute URL β sends to external server -->
<form action="https://api.example.com/subscribe">β¦</form>
<!-- No action or empty string β submits to current page URL -->
<form action="">β¦</form>
<form>β¦</form>
action or setting it to "" causes the browser to submit back to the current page URL. This is common when a server-side script on the same page handles the data.
The method Attribute
The method attribute controls the HTTP method used to send the data. It accepts two values: get and post (case-insensitive).
<form action="/search" method="GET">β¦</form>
<form action="/login" method="POST">β¦</form>
GET vs POST β Key Differences
Choosing the right method matters for security, bookmarkability, and server behaviour.
| Feature | GET | POST |
|---|---|---|
| Where data goes | Appended to URL as query string: ?name=Alice&age=30 | Sent in the request body β not visible in URL |
| Visible in browser | Yes β appears in address bar and browser history | No β data is in the request body |
| Bookmarkable | Yes β the full URL with data can be saved | No β URL doesn't contain the data |
| Cached by browser | Can be cached | Not cached by default |
| Data size limit | ~2000 characters (URL length limit) | No practical limit |
| Use for | Search forms, filters, non-sensitive queries | Login, registration, checkout, file upload |
| Security | Lower β data visible in logs and history | Higher β data not in URL (use HTTPS too) |
The label Element
The <label> element provides a text description for a form control. It improves usability and is essential for accessibility β screen readers read the label aloud when a user focuses the associated input.
Connect a label to its input using the for attribute on the label and a matching id on the input.
<!-- Explicit label: for="" matches input id="" -->
<label for="username">Username</label>
<input type="text" id="username" name="username">
<!-- Implicit label: input nested inside label (no for/id needed) -->
<label>
Email address
<input type="email" name="email">
</label>
Basic Text Input and Submit Button
The simplest possible form has one text input and a submit button. The type="text" input accepts any text, and type="submit" creates the button that sends the form.
<form action="/search" method="GET">
<label for="query">Search the site</label>
<input type="text" id="query" name="q" placeholder="Enter a topicβ¦">
<input type="submit" value="Search">
</form>
When the user types "HTML forms" and clicks Search, the browser navigates to /search?q=HTML+forms.
The name Attribute β How Data is Keyed
The name attribute on each input is the key that identifies that piece of data when the form is submitted. Without a name, the browser silently omits that field from the submitted data.
<form action="/register" method="POST">
<label for="first-name">First name</label>
<input type="text" id="first-name" name="first_name">
<label for="last-name">Last name</label>
<input type="text" id="last-name" name="last_name">
<label for="email-addr">Email</label>
<input type="email" id="email-addr" name="email">
<input type="submit" value="Create account">
</form>
<!-- POST body sent to server (URL-encoded):
first_name=Alice&last_name=Smith&email=alice%40example.com -->
Notice the difference between id (used only to connect a label) and name (used by the browser to build the submitted data). Both can be the same value, but they serve different purposes.
What Happens on Form Submit
When a user clicks a submit button (or presses Enter in a single-field form), the browser:
- Collects all named form controls inside the
<form>element. - Encodes them as key-value pairs using the
nameand currentvalueof each control. - Sends an HTTP request to the
actionURL using the specifiedmethod. - Navigates to the response returned by the server.
For a GET form, the data is appended to the URL as a query string. For a POST form, the data travels in the invisible request body.
Complete Multi-Field Form Example
Here is a realistic contact form combining everything above:
<form action="/contact/send" method="POST">
<div class="form-group">
<label for="contact-name">Your name</label>
<input type="text" id="contact-name" name="name" placeholder="Alice Smith">
</div>
<div class="form-group">
<label for="contact-email">Email address</label>
<input type="email" id="contact-email" name="email" placeholder="alice@example.com">
</div>
<div class="form-group">
<label for="contact-subject">Subject</label>
<input type="text" id="contact-subject" name="subject" placeholder="Question about billingβ¦">
</div>
<div class="form-group">
<label for="contact-message">Message</label>
<textarea id="contact-message" name="message" rows="5" placeholder="Your message hereβ¦"></textarea>
</div>
<button type="submit">Send message</button>
</form>
π Summary
<form action="" method="">β wraps all form controls;actionis the destination URL,methodis GET or POST.- GET appends data to the URL β good for searches and filters; never for passwords.
- POST sends data in the request body β required for sensitive data, file uploads, and destructive actions.
<label for="id">β links a text label to an input; clicking the label focuses the input; essential for accessibility.nameattribute on inputs β the key used to identify that field in the submitted data. Without it, the field is not sent.idvsnameβidconnects the label;nameidentifies the data in the submission.
Frequently Asked Questions
What is the default method if I don't specify one?
The default method is GET. If you omit the method attribute entirely, the browser sends a GET request with form data appended to the URL as a query string. Always explicitly specify method="POST" for any form that creates, updates, or deletes data β or that collects sensitive input.
Does every input need both an id and a name?
They serve different purposes. The name attribute is required for a field to be included in form submission data. The id attribute is required for an explicit <label for=""> connection. You can use the same string for both (e.g. id="email" name="email"), which is the most common pattern. If you nest the input inside its label, the id is optional β but name is still needed for submission.
Can I have multiple forms on one page?
Yes. Each <form> element is independent. Its controls only submit together with that specific form. A common pattern is a search form in the header and a newsletter signup form in the footer, coexisting on the same page without interfering with each other.
Is POST more secure than GET?
POST hides data from the URL, which prevents it appearing in browser history, server logs, and the HTTP Referer header. However, POST data is still transmitted in plain text unless you use HTTPS. Always use HTTPS β with HTTPS, both GET and POST requests are encrypted in transit. POST alone without HTTPS is not secure.