You can also just do a normal form post request into an invisible iframe that is generated by the attacker's javascript.