HTML forms: choose GET for retrieval and POST for a state change

Use it for a real task

A receipt search is read-only and uses GET so the query can appear in the URL. Approval is a state change and uses POST. These are different endpoint contracts; a browser form does not provide authorization, replay protection, or a server-side validation rule.

<form action="/receipts/search" method="get">
  <label for="receipt-query">Receipt ID</label>
  <input id="receipt-query" name="receipt" type="search">
  <button type="submit">Search receipts</button>
</form>
<form action="/receipts/approve" method="post">
  <input type="hidden" name="receipt_id" value="R-47">
  <button type="submit">Approve R-47</button>
</form>

What the markup guarantees

The POST endpoint must authenticate the user, authorize the specific receipt, validate the ID, and apply a request-forgery defense appropriate to its session model. A hidden input can be edited by a client.

Cost and limits

Native form submission works without JavaScript and has predictable keyboard behavior. Network and server costs depend on the endpoint and payload, not on the presence of a form element.