The data
The form data is the name=value pairs of the fields, in page order, joined with & and encoded as application/x-www-form-urlencoded: a space becomes +, reserved and non-ASCII bytes become %XX. Values are converted from the machine’s character set to ASCII first.
What each field sends is listed on its page; unticked checkboxes, unpressed buttons and reset send nothing.
GET
The data is appended to the address after ?, or after & if the address already has a query:
GET /search.php?q=paradroid&max=10 HTTP/1.0
Host: example.comPOST
The data is the request body, with Content-Type: application/x-www-form-urlencoded and Content-Length:
POST /guestbook.php HTTP/1.0
Host: example.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 39
name=Anna&msg=Hello+from+my+C64&send=okThe response
The response is shown as a new page. A client never sends a POST again by itself: going back or reloading doesn’t resubmit the form.
Security
Plain HTTP sends everything readable, passwords included, and so does the connection between a machine and its HTTPS proxy. Not supported in 8TML 1: cookies (use hidden fields or tokens in addresses instead) and file uploads. Scripted buttons will never be part of 8TML.