Transform your org with innovative, secure, cloud-native AI solutions today.. CONTACT US

HTML form attributes: action, method, enctype & more


Overview

An HTML form is used to collect user input and submit it to a server. The <form> element is a container for input controls — text fields, checkboxes, radio buttons, file uploads, and submit buttons — and the attributes on the <form> element itself determine what happens when those controls are submitted.
Understanding form attributes is foundational to both front-end development and back-end integration. Whether you are building a contact form for a Next.js application, a file upload interface, or a complex multi-step form for a government portal, every attribute described here has a direct effect on the HTTP request that leaves the browser.
This guide covers all eight core <form> attributes, their default values, accepted values, and the equivalent property on the HTMLFormElement JavaScript API. Where relevant, we note how each attribute interacts with others.

Attribute Reference Table

AttributeDefaultJS property
actionCurrent page URL (empty string).action
methodget.method
enctypeapplication/x-www-form-urlencoded.enctype
target_self.target
novalidate Absent (validation enabled).noValidate
autocompleteon.autocomplete
nameNone.name
relNone.rel

action

Syntax

HTML
<form action="URL">
  <!-- form controls -->
</form>
The value must be a valid relative or absolute URL. All three of the following are valid:
HTML
<!-- Absolute URL -->
<form action="https://api.example.com/submit">

<!-- Relative URL -->
<form action="/contact/submit">

<!-- Current page (default behavior — action omitted) -->
<form method="post">

Default value

The default value is an empty string (""), which causes the browser to submit to the URL of the document containing the form — the current page. This is identical to setting action="" explicitly. If you want to submit to the same page, the cleanest approach is to omit the attribute entirely.

Example — full form with action

HTML
<form action="/contact/submit" method="post">
  <label for="fname">First name:</label>
  <input type="text" id="fname" name="fname">

  <label for="email">Email:</label>
  <input type="email" id="email" name="email">

  <input type="submit" value="Send">
</form>

Overriding action per button

A submit button can override the form's action using the formaction attribute. This lets a single form submit to different endpoints depending on which button is clicked:
HTML
<form action="/default-endpoint" method="post">
  <input type="text" name="query">
  <button type="submit">Save draft</button>
  <button type="submit" formaction="/publish-endpoint">Publish</button>
</form>

JavaScript API

Read or set the action URL via HTMLFormElement.action:
JavaScript
const form = document.querySelector('form');

// Read
console.log(form.action); // "https://example.com/contact/submit"

// Set dynamically
form.action = '/new-endpoint';
Note: Reading form.action always returns the resolved absolute URL, even if the HTML attribute was a relative path.

MDN reference


Why your form action isn’t working

Even when correctly defined, the action attribute can fail due to subtle issues in frontend configuration, backend routing, or browser security policies. The following are the most common causes developers encounter in production systems.

method

Syntax

HTML
<form method="get | post | dialog">

Accepted values

ValueBehaviorWhen to use
get (default)defaultAppends form data to the URL as query parameters (e.g., ?key=value).Search forms, filters, and any query you want to be bookmarkable.
postSends form data in the HTTP request body; data is not visible in the URL.Login screens, contact forms, file uploads, or when handling sensitive data.
dialogCloses the nearest ancestor <dialog> element and sets its return value to the submitted data.Forms located specifically inside <dialog> elements.

GET example

HTML
<form action="/search" method="get">
  <input type="text" name="q" placeholder="Search...">
  <button type="submit">Search</button>
</form>
<!-- Submits to: /search?q=your+query -->

POST example

HTML
<form action="/login" method="post">
  <input type="email" name="email">
  <input type="password" name="password">
  <button type="submit">Log in</button>
</form>
<!-- Credentials are sent in the request body, not the URL -->

JavaScript API

JavaScript
const form = document.querySelector('form');
console.log(form.method); // "get" or "post"
form.method = 'post';
You can override method per submit button using the formmethod attribute, exactly as with formaction.

MDN reference


enctype

Syntax

HTML
<form method="post" enctype="MIME-type">

Accepted values

ValueBehaviorWhen to use
application/x-www-form-urlencoded (default)defaultEncodes data as URL-encoded key=value pairs. Spaces become + and special characters are percent-encoded.Use for all standard forms that do not include file uploads.
multipart/form-dataSends data as multipart MIME parts. This preserves binary file content without encoding it into a text string.Required for any form containing an <input type="file">.
text/plainSends data as plain text without any special encoding. This is generally not reliable for machine parsing.Use for debugging purposes only; it is not suitable for production.

File upload example

HTML
<form action="/upload" method="post" enctype="multipart/form-data">
  <label for="avatar">Upload profile photo:</label>
  <input type="file" id="avatar" name="avatar" accept="image/*">
  <button type="submit">Upload</button>
</form>
If you forget to set enctype="multipart/form-data" on a form with a file input, the server receives only the filename string, not the file's binary content.
For a deep dive into the default encoding type, see our article on application/x-www-form-urlencoded.

JavaScript API

JavaScript
const form = document.querySelector('form');
console.log(form.enctype); // "application/x-www-form-urlencoded"
form.enctype = 'multipart/form-data';

MDN reference


target

Syntax

HTML
<form action="/submit" method="post" target="_blank">

Accepted values

ValueBehavior
_self (default)defaultLoads the response in the current browsing context (the same tab or frame where you clicked the link).
_blankOpens the response in a new browsing context, usually a new tab or a new window.
_parentLoads the response in the parent browsing context of the current one. If there is no parent, this behaves like _self.
_topLoads the response into the full body of the window, effectively "breaking out" of any nested iframes.
framenameLoads the response in a specific, named <iframe>. Use the name attribute of the iframe as the value.

Example

HTML
<form action="/search" method="get" target="_blank">
  <input type="text" name="q">
  <button type="submit">Search in new tab</button>
</form>
When using target="_blank", consider adding rel="noopener noreferrer" via the rel attribute to prevent the new page from accessing window.opener.

JavaScript API

JavaScript
const form = document.querySelector('form');
console.log(form.target); // "_self"
form.target = '_blank';

MDN reference


novalidate

Quick answer: The novalidate boolean attribute disables native browser form validation when present. This is useful when you are implementing custom validation logic in JavaScript or a framework like React.

Syntax

HTML
<form action="/submit" method="post" novalidate>
Because novalidate is a boolean attribute, its mere presence — regardless of value — activates it. The following are all equivalent:
HTML
<form novalidate>
<form novalidate="">
<form novalidate="novalidate">

When to use it

Browser-native validation (required fields, email format, min/max lengths) runs before the form submits. If you have a JavaScript validation library — Zod, Yup, React Hook Form, Formik — you typically want to handle all validation yourself and suppress the browser's built-in UI. Add novalidate to the form element to do this cleanly.
JSX
{/* React Hook Form pattern */}
<form onSubmit={handleSubmit(onSubmit)} noValidate>
  <input {...register("email", { required: true, pattern: /^\S+@\S+$/i })} />
  {errors.email && <span>Email is required</span>}
  <button type="submit">Submit</button>
</form>

Per-button override

You can also suppress validation for a specific submit button using formnovalidate on the button — for example, a "Save draft" button that does not require all fields to be complete:
HTML
<form action="/submit" method="post">
  <input type="email" name="email" required>
  <button type="submit">Submit</button>
  <button type="submit" formaction="/save-draft" formnovalidate>Save draft</button>
</form>

JavaScript API

JavaScript
const form = document.querySelector('form');
console.log(form.noValidate); // false (note: camelCase in JS)
form.noValidate = true;

MDN reference


autocomplete

Syntax

HTML
<form action="/submit" method="post" autocomplete="on | off">

Example — disabling autocomplete for a payment form

HTML
<form action="/payment" method="post" autocomplete="off">
  <input type="text" name="card-number" placeholder="Card number">
  <input type="text" name="cvv" placeholder="CVV">
  <button type="submit">Pay</button>
</form>
Individual <input> elements can override the form-level setting using their own autocomplete attribute. The <input autocomplete> attribute accepts a richer vocabulary of tokens (e.g., email, current-password, one-time-code) that tell the browser exactly what type of data a field expects.

JavaScript API

JavaScript
const form = document.querySelector('form');
console.log(form.autocomplete); // "on"
form.autocomplete = 'off';

MDN reference


name

Syntax

HTML
<form name="contactForm" action="/contact" method="post">

Accessing a named form in JavaScript

JavaScript
// Via document.forms collection
const form = document.forms['contactForm'];

// Or equivalently
const form = document.forms.contactForm;

// Trigger submission programmatically
form.submit();
The name attribute on the <form> element is distinct from the name attribute on input elements. On inputs, name determines the key in the submitted form data payload. On the form itself, name is purely an identifier for script access.

JavaScript API

JavaScript
const form = document.querySelector('form');
console.log(form.name); // "contactForm"

MDN reference


rel

Syntax

HTML
<form action="https://external.example.com/submit" method="post" rel="noopener noreferrer">

Common values

ValueBehavior
noopenerPrevents the newly opened page from accessing the window.opener property of the original page. This is a critical security measure for target="_blank".
noreferrerInstructs the browser not to send the Referer HTTP header to the destination. It also automatically triggers the noopener behavior.
externalInforms the browser and search engines that the link leads to a document on a different domain/site.
helpSignals that the linked resource contains help or documentation specifically related to the current context.

JavaScript API

JavaScript
const form = document.querySelector('form');
console.log(form.rel); // "noopener noreferrer"
form.rel = 'noopener';

MDN reference


Grouping controls: fieldset and legend

While not attributes of <form> itself, <fieldset> and <legend> are elements commonly used inside forms to group related controls. A <fieldset> visually and semantically groups a set of controls; <legend> provides a caption for that group. This grouping is especially important for accessibility — screen readers announce the legend text before reading each field inside the fieldset.
HTML
<form method="post" action="/preferences">
  <fieldset>
    <legend>Do you agree to the terms?</legend>
    <label>
      <input type="radio" name="terms" value="yes"> Yes
    </label>
    <label>
      <input type="radio" name="terms" value="no"> No
    </label>
  </fieldset>
  <button type="submit">Continue</button>
</form>

HTMLFormElement JavaScript API

Every attribute described above has a corresponding property on the HTMLFormElement interface, accessible after selecting the form with document.querySelector, document.getElementById, or document.forms.
HTML attributeJS propertyR/WType
actionform.actionR/WString (resolved absolute URL)
methodform.methodR/W"get" | "post" | "dialog"
emctypeform.enctypeR/WString (MIME type)
targetform.targetR/WString
novalidateform.noValidateR/WBoolean
autocompleteform.autocompleteR/W"on" | "off"
nameform.nameR/WString
relform.relR/WString
form.elementsRHTMLFormControlsCollection
form.lengthRNumber (count of controls)

Programmatic submission and reset

JavaScript
const form = document.getElementById('myForm');

// Submit without triggering the submit event
form.submit();

// Reset all fields to their default values
form.reset();

// Check validity without submitting
const isValid = form.checkValidity(); // returns boolean
form.reportValidity();               // shows native validation UI
For more on JavaScript form handling, see our article on understanding JavaScript form submission.

The Evolution of Form Handling: Legacy vs. Modern

1. The Legacy HTML Approach This traditional method uses the action attribute to point toward a specific server-side URL, a pattern common in older Drupal or PHP-based systems.
HTML
<form action="/api/v1/submit-data" method="POST">
  <label for="email">Email:</label>
  <input type="email" id="email" name="email" required />
  <button type="submit">Submit to Server</button>
</form>
2. The Modern Next.js Server Action Utilizing our modern tech stack (Next.js ^16.1.2 and TypeScript ^5.0.4), we bridge the gap between backend engineering and seamless human interaction. This approach eliminates the need for manual API route management and provides end-to-end type safety.
/apt/actions.ts
// app/actions.ts - Secure Server-Side Logic
'use server'

import { revalidatePath } from 'next/cache';

export async function handleSecureIntake(formData: FormData) {
  const email = formData.get('email');

  // Logic forged in high-stakes environments like BNY Mellon [cite: 62, 98]
  // Process data securely with "correct-by-design" rigor [cite: 70]
  console.log(`Processing secure intake for: ${email}`);

  // Trigger on-demand ISR via your revalidateCache route [cite: 14, 26, 55]
  revalidatePath('/[locale]/marketing-pages'); 
}

// components/ModernForm.tsx - Seamless Frontend Interaction
import { handleSecureIntake } from '../app/actions';

export default function ModernForm() {
  return (
    <form action={handleSecureIntake} className="bg-background-light p-6 rounded-lg">
      <input 
        type="email" 
        name="email" 
        placeholder="Enter NYC Enterprise Email"
        className="border-border text-primary-dark"
      />
      <button type="submit" className="bg-primary hover:bg-primary-dark text-white">
        Execute Server Action
      </button>
    </form>
  );
}
Secure Server-Side Logic

Enterprise form patterns for NYC web applications

For teams building web applications in New York City's fintech, healthcare, and government sectors, HTML form attributes take on additional significance. Several common patterns are worth noting.
Fintech and financial services — Applications serving firms in the BNY Mellon ecosystem typically require autocomplete="off" on fields containing account numbers or routing numbers, novalidate on forms with custom validation rules sourced from DROOLS decision tables, and enctype="multipart/form-data" on document upload workflows. See our BNY Mellon case study for real-world context.
E-government portals — NYC government web applications must comply with WCAG 2.1 AA. This means every <input> requires a properly associated <label>, and <fieldset>/<legend> groupings are mandatory for radio and checkbox groups. Form action URLs must point to HTTPS endpoints, and method="post" is required for any form collecting personally identifiable information. For deeper guidance, see our article on e-government website development best practices.
Healthcare platforms — Electronic health record systems and patient intake forms in the NYC metro area operate under HIPAA constraints. File upload forms must use enctype="multipart/form-data" and submit to authenticated endpoints. Form target should never be _blank for forms containing PHI. See our article on scaling behavioral health EHR systems in NYC.
Universal Equations architects enterprise-grade form handling, AEM Forms integration, and DROOLS-based validation logic for organizations across the New York metro area. Get in touch to discuss your project.

Frequently asked questions


References

  1. 1."<form>: The Form element." MDN Web Docs. Accessed May 3, 2026.
  2. 2."form HTML attribute." MDN Web Docs. Accessed May 3, 2026.
  3. 3."HTMLFormElement." MDN Web Docs. Accessed May 3, 2026.
  4. 4."Sending and retrieving form data." MDN Web Docs. Accessed May 3, 2026.
  5. 5."The form element." WHATWG HTML Living Standard. Accessed May 3, 2026.
  6. 6."HTML Form Attributes." W3Schools. Accessed May 3, 2026.
  7. 7."<form> — React." React documentation. Accessed May 3, 2026.