Learning Objectives
Understand HTML forms as the original client-to-server data mechanism
Distinguish between GET forms (data in URL) and POST forms (data in body)
Identify common form controls and their purposes
Recognize that forms work without JavaScript
GET Forms: Data in the URL
HTML forms are the original mechanism for sending data from the client to the server. Before fetch(), before XMLHttpRequest, before any JavaScript at all — forms were the only way users could send data. Be careful here: this is more about their foundational nature as opposed to being somehow out of date.
When a form uses method="GET", the form data is appended to the URL as query parameters:
<form action="/search" method="GET">
<input type="text" name="q" value="javascript">
<button type="submit">Search</button>
</form>
<!-- Submitting navigates to: /search?q=javascript -->
POST Forms: Data in the Body
When a form uses method="POST", the form data is sent in the HTTP request body, not the URL:
<form action="/signup" method="POST">
<input type="text" name="firstName">
<input type="text" name="lastName">
<select name="size">
<option value="small">Small</option>
<option value="medium">Medium</option>
<option value="large">Large</option>
</select>
<button type="submit">Submit</button>
</form>
Common Form Controls
Control
HTML
Purpose
Text input
<input type="text">
Single-line text entry
Password
<input type="password">
Masked text entry (but still plaintext in the request!)
Hidden
<input type="hidden">
Data sent with form but not displayed (but visible in source!)
Dropdown
<select>
Choose from predefined options
Textarea
<textarea>
Multi-line text entry
Checkbox
<input type="checkbox">
Boolean toggle (only sent when checked)
Before fetch(), forms were the only way to send data to a server.
They still work without JavaScript — which is why progressive enhancement starts with forms. The HTTP section covers the encoding formats (application/x-www-form-urlencoded, multipart/form-data, JSON) that forms and APIs use.
Key Takeaways
GET puts data in the URL; POST puts data in the body.
Forms work without JavaScript — start there and progressively enhance.
Password masking and hidden fields are UX conveniences, not security measures.