只使用

?

<form action="?" method="post" enctype="multipart/form-data" name="myForm" id="myForm">

它并不违反HTML5标准。

只使用

?

<form action="?" method="post" enctype="multipart/form-data" name="myForm" id="myForm">

它并不违反HTML5标准。

I use to do not specify action attribute at all. It is actually how my framework is designed all pages get submitted back exact to same address. But today I discovered problem. Sometimes I borrow action attribute value to make some background call (I guess some people name them AJAX). So I found that IE keeps action attribute value as empty if action attribute wasn't specified. It is a bit odd in my understanding, since if no action attribute specified, the JavaScript counterpart has to be at least undefined. Anyway, my point is before you choose best practice you need to understand more context, like will you use the attribute in JavaScript or not.

当你放空动作时，一些安全过滤认为它是恶意的或网络钓鱼。因此，他们可以阻止你的页面。所以建议不要让action=为空。

如果不包含action属性，页面会被iframe点击劫持攻击，这涉及到几个简单的步骤:

攻击者将您的页面包装在iframe中 iframe URL包含一个与表单字段同名的查询参数 提交表单时，将查询值插入到数据库中 用户的身份信息(电子邮件，地址等)已被泄露

参考文献

绕过CSRF保护ClickJacking和HTTP参数污染

这将在HTML5中验证。

<form action="#">