Is it a good practice to use an empty URL for a HTML form's action attribute? (action="")

Question

I am wondering if anyone can give a "best practices" response to using blank HTML form actions to post back to the current page.

There is a post asking what a blank HTML form action does here and some pages like this one suggest it is fine but I'd like to know what people think.

• Will Morgan: Suggesting "best-practices" tag be applied to this.
• Jackie: To doubly confirm, leave the action blank, or simply don't mention an action at all (like <form name="xyz" >). It will submit the action on its own.
• Paul Sweatte: Not including the action attribute opens the page up to iframe clickjacking attacks, such as one in which an attacker wraps your page in an iframe and the iframe URL includes a query param with the same name as a form field. When the form is submitted, the query value is inserted into the database, so the user's identifying information (email, address, etc) has been compromised.
• Costa Michailidis: So then, what's the valid, secure way to submit a form to the current page?
• Suncat2000: Not including the action attribute is also invalid HTML. It is in the specification as a required attribute. Empty actions also have their own quirks: stackoverflow.com/a/617197/1307074.

Answer 1

The best thing you can do is leave out the action attribute altogether. If you leave it out, the form will be submitted to the document's address, i.e. the same page.

It is also possible to leave it empty, and any browser implementing HTML's form submission algorithm will treat it as equivalent to the document's address, which it does mainly because that's how browsers currently work:

8. Let action be the submitter element's action.

9. If action is the empty string, let action be the document's address.

Note: This step is a willful violation of RFC 3986, which would require base URL processing here. This violation is motivated by a desire for compatibility with legacy content. [RFC3986]

This definitely works in all current browsers, but may not work as expected in some older browsers ("browsers do weird things with an empty action="" attribute"), which is why the spec strongly discourages authors from leaving it empty:

The action and formaction content attributes, if specified, must have a value that is a valid non-empty URL potentially surrounded by spaces.

• derobert: Possibly this has changed since your answer (its been almost three years), but as of today, HTML5 does not allow action=""—see my answer...
• mercator: @derobert Thanks. This probably hadn't changed. I've changed my answer to better reflect what the spec says.
• Joey: Leaving out action attribute altogether is comfortable and I myself do so but @Paul Sweatte later in this post argues it opens the page up for iframe clickjacking attack. So is this still a recommended practice?
• JPA: Bad answer!!! Answer is NO, it is NOT a good practice to leave the action attribute of a form empty. And NO, it is NOT a good practice to leave the whole attribute out alltogether. You should find out what address the page is on and use this in the action attribute of the form, THAT is GOOD practice. [SMH]

Answer 2

Actually, the Form Submission subsection of the current HTML5 draft does not allow action="". It is against the spec.

The action and formaction content attributes, if specified, must have a value that is a valid non-empty URL potentially surrounded by spaces. (emphasis added)

The quoted section in mercator's answer is a requirement on implementations, not authors. Authors must follow the author requirements. To quote How to read this specification:

In particular, there are conformance requirements that apply to producers, for example authors and the documents they create, and there are conformance requirements that apply to consumers, for example Web browsers. They can be distinguished by what they are requiring: a requirement on a producer states what is allowed, while a requirement on a consumer states how software is to act.

The change from HTML4—which did allow an empty URL—was made because "browsers do weird things with an empty action="" attribute". Considering the reason for the change, its probably best not to do that in HTML4 either.

• Kerrick: Does it allow the total absence of the action attribute altogether to indicate the form should submit to the document address? It seems to, since it says, "if specified."
• derobert: @Kerrick Yes, I believe HTML5 allows omitting the action attribute entirely, and defaults it to empty string. HTML4 did not, it specifies action as required.
• serfer2: I agree with @Kerrick, it is allowed to omit the action attribute. Reading at current HTML5 draf, it seems that empty string is not allowed but the absence of the attribute is allowed. But in any case, for compatibility reasons, I recommend you to always include the "action" attribute and fill it with a valid non-empty URL (good practices are always the best way).
• Asmor: One potential gotcha: AngularJS will prevent submission of forms without an action attribute. Probably not a common problem, but it took me a while to figure out why parts of our legacy site started breaking.
• run_the_race: This answer confused me, when I first read it 6 months ago I thought it was saying the accpeted answer is wrong. I think it may help to clarify that its preferable to leave the attribute out, but if the attrbiute exists, give it a none blank value.

Answer 3

Not including the action attribute opens the page up to iframe clickjacking attacks, which involve a few simple steps:

• An attacker wraps your page in an iframe
• The iframe URL includes a query param with the same name as a form field
• When the form is submitted, the query value is inserted into the database
• The user's identifying information (email, address, etc) has been compromised

References

• Bypassing CSRF protections with ClickJacking and HTTP Parameter Pollution

• Calmarius: Isn't the iframe URL contain GET parameters, while forms usually submitted using POST? So if the site only deals with the POST parameters then it shouldn't be a problem isn't it? At least I usually use the $_POST array in PHP only when processing forms.
• Paul Sweatte: @Calmarius Yes, use $_POST instead of $_REQUEST to avoid this. If framework code uses $_REQUEST, use an iframe buster.

Answer 4

This will validate with HTML5.

<form action="#">

• Matt Mitchell: I haven't tried it, but conceptually wouldn't that scroll to the top of the page after submission?
• s427: Couldn't you use action="." ?
• Chris Broski: action="?" works well too. It validates and points to the current page without and query string data.
• Torsten Bronger: action="." is a bad idea for the general case. An URL like example.com/login is mapped to merely example.com/.
• GeorgeButter: This answer is only valid if the user wants to scroll to the top of the page.

Answer 5

IN HTML 5 action="" IS NOT SUPPORTED SO DON'T DO THIS. BAD PRACTICE.

If instead you completely negate action altogether it will submit to the same page by default, I believe this is the best practice:

<form>This will submit to the current page</form>

If you are sumbitting the form using php you may want to consider the following. read more about it here.

<form method="post" action="<?php echo htmlspecialchars($_SERVER["PHP_SELF"]);?>">

Alternatively you could use # bear in mind though that this will act like an anchor and scroll to the top of the page.

<form action="#">

• Richard Young: You ommit the action attribute, is the form still open to exploits are detailed on the frist page on the link?
• GeorgeButter: @RichardYoung Sorry I don't understand your question. Please rephrase.
• Richard Young: The $_SERVER["PHP_SELF"] variable can be used by hackers. If PHP_SELF is used in your page then a user can enter a slash (/) and then some Cross Site Scripting (XSS) commands to execute. If you omit the action attribute, are you still vulnerable to this?
• GeorgeButter: Yes, you are. The action attribute can be added back in client side and given any value of choice. However using the htmlspecialchars() function stops people from people from using your php script against you.
• Richard Young: I knew about the htmlspecialchars() function but was just hoping if I ommited the action that I could get around it. Thanks for clearing that up for me.

Answer 6

I think it's best to explicitly state where the form posts. If you want to be totally safe, enter the same URL the form is on in the action attribute if you want it to submit back to itself. Although mainstream browsers evaluate "" to the same page, you can't guarantee that non-mainstream browsers will.

And of course, the entire URL including GET data like Juddling points out.

• JPA: It IS best practice to EXPLICITLY state where the form posts. But you're the winner with the best answer.

Answer 7

Just use

?

<form action="?" method="post" enctype="multipart/form-data" name="myForm" id="myForm">

It doesn't violate HTML5 standards.

• vikki: I didn't downvote but your method will drop all the get params. A form on the following url would break example.com/update_user?user_id=1 because the form will submit to example.com/update_user?

Answer 8

When you put empty action then some security filtration consider it malicious or phishing. Hence they can block your page. So its advisable not to keep action= blank.

Answer 9

I used to do this a lot when I worked with Classic ASP. Usually I used it when server-side validation was needed of some sort for the input (before the days of AJAX). The main draw back I see is that it doesn't separate programming logic from the presentation, at the file level.

• markus: why not? I think it's not connected. I can have a form post the data to the same page and build this page with proper separation of controller and view.
• JPA: I used to use a lot of soap under the shower. I learned it was bad for my skin. Want a beer?

Answer 10

I use to do not specify action attribute at all. It is actually how my framework is designed all pages get submitted back exact to same address. But today I discovered problem. Sometimes I borrow action attribute value to make some background call (I guess some people name them AJAX). So I found that IE keeps action attribute value as empty if action attribute wasn't specified. It is a bit odd in my understanding, since if no action attribute specified, the JavaScript counterpart has to be at least undefined. Anyway, my point is before you choose best practice you need to understand more context, like will you use the attribute in JavaScript or not.