HTML5 forms cannot have a blank action

validator.nu now reports an error for the empty action in <form action="">. An empty action used to send the form data back to the current page, whatever it was. This was useful for repeating the same form code on different pages, and for developing a form on a site that is in development and where the official target URLs can change.

In January 2011, the HTML5 spec changed to specify that action may not be empty. Yet the whatwg spec still says that blank actions are allowed (while saying that is a violation of RFC3986 which defines a URL, which makes no sense). Of course, HTML5 is a "living spec" so it can change tomorrow (Next week: every landing page must have a commented ascii goatse in its source). So what's the story?

The story is in the comments to w3 bug #12561. The chief complaint hixie makes is that this use of a relative path to the current URL conflicts with the <base> tag which allows site developers to redefine all relative paths. This sequence can happen:

1. Developers create pages with form action="" to send data back to the current URL.
2. An automated process later adds a <base> tag which rewrites the base of all relative URLs.
3. Form data is now sent back to the URL relative to the <base> tag, meaning it goes to the <base> url.

I consider that to be operating exactly as defined, with <form action> going to the same place that <a href=""> goes to, but hixie sees it as a problem whose best solution is to outlaw empty action attributes.

Another of hixie's criticisms in that action="" is "too confusingly similar to action=" " with a space which has different behaviour." By my understanding of things, action=" " with a single space should be treated the same as action="%20" and should refer to the filename that is a single space in the same directory as the current URL. In testing, Opera strips the whitespace and sends data back to the current URL, so I don't see a difference in behaviour. The html5 spec says that URLs should be trimmed of whitespace.

One resolution that hixie recommends is to exclude the action attribute altogether. My recollection from many years ago is that browsers would do nothing when no action attribute is specified, but today this has the same effect as a blank action. This seems to be the best thing to do.

Another recommendation is to use action="?", which I do not agree with. For one, this should have the exact same problem with <base> that "" does, since it is a relative URL to the base URL: + "?". In my testing, it in fact does have this problem. It also causes the minor inconvenience of there being two URLs for the same resource when POSTing data, and when GETing this could theoretically produce invalid URLs that have two "?" characters in them except for the fact that browser developers saw plenty of buggy urls like this produced by shit code in the 1990s and know how to handle it.

Related:

• In Bug #10332 and Bug #11161, people have read the spec to expect the DOM to report the current URL when the action attribute is an empty string. I believe this is mistaken.