The form Element, action, and method

A form groups controls whose values can be submitted. The action attribute identifies the destination, and method controls how the data is sent.

<form action="/search/" method="get">
  <label for="q">Search articles</label>
  <input id="q" name="q" type="search">
  <button type="submit">Search</button>
</form>

With GET, successful controls are encoded into the URL as query parameters. This is appropriate for searches and other requests that retrieve information. Use POST when the form is asking the server to process or change something, such as creating an account or submitting feedback.

The browser can submit a form, but a server endpoint must exist to receive and process it. HTML alone does not store a newsletter subscriber or create an account.

Client-side validation helps people correct mistakes, but it is not a security boundary. A server must validate all submitted data, enforce authorization, handle unexpected input, and protect state-changing requests against relevant attacks. Never trust a value because it came from a form with required or pattern.