HTML Forms: GET versus POST

A form sends its fields to the address in action using the HTTP method in method. With GET the fields are added to the URL as a query string, so the form below requests /search?q=tcp. GET is for reading data: the URL can be bookmarked, cached, and shared, but it is also stored in history and server logs, so it must not carry secrets. With POST the fields travel in the request body, which is for actions that change something on the server and for sensitive values such as passwords. POST requests are not cached or bookmarked by default.

<form action="/search" method="get">
  <label for="q">Search</label>
  <input id="q" name="q" value="tcp">
  <button type="submit">Search</button>
</form>

<form action="/login" method="post">
  <input name="user" autocomplete="username">
  <input name="password" type="password" autocomplete="current-password">
  <button type="submit">Log in</button>
</form>