5 Ways To Handle Request Forms In Flask

Quick Links :

Request forms are a crucial part of any web application, allowing users to interact with the application and provide data that can be used to perform various actions. In Flask, a popular Python web framework, handling request forms is relatively straightforward. However, it requires a good understanding of how to work with forms, validate user input, and handle form data.

In this article, we will explore five ways to handle request forms in Flask. We will cover the basics of working with forms in Flask, including how to create forms, validate user input, and handle form data. We will also discuss more advanced topics, such as how to use Flask-WTF to handle forms and how to handle file uploads.

1. Creating Forms in Flask

Before we dive into handling request forms in Flask, let's first cover how to create forms in Flask. In Flask, you can create forms using the request object, which is a global object that provides access to the current request.

Here is an example of how to create a simple form in Flask:

from flask import Flask, request, render_template

app = Flask(__name__)

@app.route('/form', methods=['GET', 'POST'])
def form():
    if request.method == 'POST':
        name = request.form['name']
        email = request.form['email']
        return 'Hello, %s!' % name
    return render_template('form.html')

In this example, we define a route for the /form URL that handles both GET and POST requests. When the form is submitted, we retrieve the name and email fields from the request.form object and return a greeting message.

Using Flask-WTF to Create Forms

While creating forms manually using the request object is possible, it's often more convenient to use a library like Flask-WTF to handle forms. Flask-WTF provides a simple way to create forms and validate user input.

Here is an example of how to create a form using Flask-WTF:

from flask import Flask, render_template
from flask_wtf import FlaskForm
from wtforms import StringField, SubmitField
from wtforms.validators import DataRequired

app = Flask(__name__)
app.config['SECRET_KEY'] = 'mysecretkey'

class MyForm(FlaskForm):
    name = StringField('Name', validators=[DataRequired()])
    email = StringField('Email', validators=[DataRequired()])
    submit = SubmitField('Submit')

@app.route('/form', methods=['GET', 'POST'])
def form():
    form = MyForm()
    if form.validate_on_submit():
        name = form.name.data
        email = form.email.data
        return 'Hello, %s!' % name
    return render_template('form.html', form=form)

In this example, we define a MyForm class that inherits from FlaskForm. We define two fields, name and email, using the StringField class from WTForms. We also define a submit field using the SubmitField class.

We then create an instance of the MyForm class and pass it to the render_template function to render the form template.

2. Validating User Input

Validating user input is an essential part of handling request forms in Flask. You can use WTForms validators to validate user input.

Here is an example of how to validate user input using WTForms validators:

from wtforms.validators import DataRequired, Email

class MyForm(FlaskForm):
    name = StringField('Name', validators=[DataRequired()])
    email = StringField('Email', validators=[DataRequired(), Email()])

In this example, we define two fields, name and email, and use the DataRequired and Email validators to validate user input.

You can also use custom validators to validate user input. Here is an example of how to define a custom validator:

from wtforms.validators import ValidationError

def validate_name(form, field):
    if len(field.data) < 3:
        raise ValidationError('Name must be at least 3 characters long')

class MyForm(FlaskForm):
    name = StringField('Name', validators=[DataRequired(), validate_name])

In this example, we define a custom validator validate_name that checks if the name field is at least 3 characters long.

3. Handling Form Data

Handling form data is an essential part of handling request forms in Flask. You can access form data using the request.form object.

Here is an example of how to handle form data:

@app.route('/form', methods=['GET', 'POST'])
def form():
    if request.method == 'POST':
        name = request.form['name']
        email = request.form['email']
        return 'Hello, %s!' % name

In this example, we access the name and email fields from the request.form object and return a greeting message.

You can also use Flask-WTF to handle form data. Here is an example of how to handle form data using Flask-WTF:

@app.route('/form', methods=['GET', 'POST'])
def form():
    form = MyForm()
    if form.validate_on_submit():
        name = form.name.data
        email = form.email.data
        return 'Hello, %s!' % name

In this example, we create an instance of the MyForm class and access the name and email fields using the data attribute.

4. Handling File Uploads

Handling file uploads is an essential part of handling request forms in Flask. You can use the request.files object to access uploaded files.

Here is an example of how to handle file uploads:

from flask import request, send_file

@app.route('/upload', methods=['GET', 'POST'])
def upload():
    if request.method == 'POST':
        file = request.files['file']
        file.save('uploads/' + file.filename)
        return 'File uploaded successfully!'

In this example, we access the uploaded file using the request.files object and save it to the uploads directory.

You can also use Flask-WTF to handle file uploads. Here is an example of how to handle file uploads using Flask-WTF:

from flask_wtf import FlaskForm
from wtforms import FileField, SubmitField

class UploadForm(FlaskForm):
    file = FileField('File')
    submit = SubmitField('Upload')

@app.route('/upload', methods=['GET', 'POST'])
def upload():
    form = UploadForm()
    if form.validate_on_submit():
        file = form.file.data
        file.save('uploads/' + file.filename)
        return 'File uploaded successfully!'

In this example, we define a UploadForm class that inherits from FlaskForm. We define a file field using the FileField class from WTForms.

We then create an instance of the UploadForm class and access the uploaded file using the data attribute.

5. Using CSRF Protection

CSRF (Cross-Site Request Forgery) protection is an essential part of handling request forms in Flask. You can use Flask-WTF to enable CSRF protection.

Here is an example of how to enable CSRF protection using Flask-WTF:

from flask_wtf import FlaskForm
from wtforms import StringField, SubmitField
from wtforms.validators import DataRequired

app = Flask(__name__)
app.config['SECRET_KEY'] = 'mysecretkey'

class MyForm(FlaskForm):
    name = StringField('Name', validators=[DataRequired()])
    email = StringField('Email', validators=[DataRequired()])
    submit = SubmitField('Submit')

@app.route('/form', methods=['GET', 'POST'])
def form():
    form = MyForm()
    if form.validate_on_submit():
        name = form.name.data
        email = form.email.data
        return 'Hello, %s!' % name

In this example, we enable CSRF protection by setting the SECRET_KEY configuration variable.

We can also use the CSRFProtect class from Flask-WTF to enable CSRF protection. Here is an example of how to enable CSRF protection using the CSRFProtect class:

from flask_wtf.csrf import CSRFProtect

csrf = CSRFProtect(app)

In this example, we create an instance of the CSRFProtect class and pass it the app object.

We can also use the @csrf.exempt decorator to exempt certain routes from CSRF protection. Here is an example of how to exempt a route from CSRF protection:

from flask_wtf.csrf import CSRFProtect, exempt

csrf = CSRFProtect(app)

@app.route('/upload', methods=['GET', 'POST'])
@csrf.exempt
def upload():
    #...

In this example, we use the @csrf.exempt decorator to exempt the /upload route from CSRF protection.

FAQ Section:

I hope this article has provided you with a comprehensive guide to handling request forms in Flask. Remember to always validate user input and use CSRF protection to prevent malicious attacks. Happy coding!