Django Forms and Validation

# CHAPTER 11

Django Forms and Validation #

1. Introduction #

2. Learning Objectives #

• Understand the difference between GET and POST requests.

• Create a ModelForm linked directly to a database schema.

• Render Django forms securely inside an HTML template.

• Implement the {% csrf_token %} to prevent security exploits.

• Validate and save form data in a View function.

3. Beginner-Friendly Explanation #

4. Step 1: Creating a ModelForm #

Create a new file: blog/forms.py

from django import forms
from .models import Post

class PostForm(forms.ModelForm):
    class Meta:
        model = Post
        # Tell Django which database columns should be editable by the user
        fields = ['title', 'content']

5. Step 2: The Form View (GET and POST) #

1. 1. GET Request: The user visits the page and wants to see a blank form.

1. 2. POST Request: The user clicked the "Submit" button and is sending data to the server.

Update blog/views.py:

from django.shortcuts import render, redirect
from .forms import PostForm

def create_post(request):
    if request.method == 'POST':
        # The user submitted data! Bind the data to the form.
        form = PostForm(request.POST)
        
        # Security Guard: Is the data valid?
        if form.is_valid():
            form.save() # Instantly saves to the database!
            return redirect('blog-home') # Send them back to the homepage
    else:
        # The user just visited the page. Show a blank form.
        form = PostForm()

    # Pass the form to the template
    return render(request, 'blog/post_form.html', {'form': form})

6. Step 3: Rendering the Form Template #

Create blog/templates/blog/post_form.html:

{% extends "blog/base.html" %}

{% block content %}
    <h1>Create a New Post</h1>
    
    <!-- Must specify method="POST" -->
    <form method="POST">
        <!-- CRITICAL SECURITY FEATURE! Must be inside every POST form -->
        {% csrf_token %}
        
        <!-- Django automatically generates the <input> and <label> tags -->
        {{ form.as_p }}
        
        <button type="submit">Publish</button>
    </form>
{% endblock %}

7. Backend Workflow: CSRF Protection #

8. Customizing Form Validation #

class PostForm(forms.ModelForm):
    class Meta:
        model = Post
        fields = ['title', 'content']

    # Clean method for the 'title' field
    def clean_title(self):
        title = self.cleaned_data.get('title')
        if len(title) < 10:
            raise forms.ValidationError("The title must be at least 10 characters long.")
        return title

*If a user types a short title, form.isvalid() in the View will return False, and Django will automatically display the error message on the HTML page!*

• Never trust user input: Always use form.isvalid(). Never try to manually extract data directly from request.POST['title'] and insert it into the database. Django's .isvalid() sanitizes the data, preventing XSS and SQL injection attacks automatically.

• Challenge: Update urls.py to include the path path('post/new/', views.createpost, name='post-create'). Start your server, navigate to the URL, and use your newly created form to publish a blog post directly to your SQLite database.

13. MCQs with Answers #

• Q: Explain the purpose of form.isvalid() in a Django View. What is happening under the hood regarding data sanitization and validation?

• Q: Describe how a Cross-Site Request Forgery (CSRF) attack works, and explain exactly how Django's CSRF token mitigates this vulnerability.

15. FAQs #

16. Summary #

17. Next Chapter Recommendation #