File uploads handling in Flask - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to import the Flask class.

Flask

from flask import [1]

Drag options to blanks, or click blank then click option'

AFlask

Brender_template

CRequest

Dredirect

Attempts:

3 left

💡 Hint

Common Mistakes

Importing Request instead of Flask

Using lowercase flask instead of Flask

The Flask class is imported from the flask module to create the app.

2fill in blank

medium

Complete the code to get the uploaded file from the request.

Flask

file = request.files.get('[1]')

Drag options to blanks, or click blank then click option'

Adata

Bfilename

Cupload

Dfile

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'filename' which is a property, not the input name

Using 'upload' or 'data' which are not standard input names

The key used to get the uploaded file from request.files should match the form input name, commonly 'file'.

3fill in blank

hard

Fix the error in saving the uploaded file securely.

Flask

filename = [1](file.filename)
file.save(filename)

Drag options to blanks, or click blank then click option'

Aos.path.basename

Bsecure_filename

Cstr

Dfile.filename.upper

Attempts:

3 left

💡 Hint

Common Mistakes

Saving file.filename directly without sanitizing

Using str() which does not sanitize

Using os.path.basename which only strips directories

Use secure_filename from werkzeug.utils to avoid unsafe file names.

4fill in blank

hard

Fill both blanks to check if the file is allowed and save it.

Flask

if file and '[1]' in file.filename and file.filename.rsplit('.', 1)[1].lower() [2] ALLOWED_EXTENSIONS:
    filename = secure_filename(file.filename)
    file.save(filename)

Drag options to blanks, or click blank then click option'

A.

Bin

Cnot in

Dstartswith

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'startswith' instead of checking for '.'

Using 'not in' which reverses the logic

Check if filename contains a dot and if the extension is in allowed extensions.

5fill in blank

hard

Fill all three blanks to create a dictionary of filenames and their sizes for allowed files.

Flask

files_info = {file.filename: [1] for file in files if '.' in file.filename and file.filename.rsplit('.', 1)[1].lower() [2] ALLOWED_EXTENSIONS and file [3] None}

Drag options to blanks, or click blank then click option'

Alen(file.read())

Bin

Cis not

Dfile.size

Attempts:

3 left

💡 Hint

Common Mistakes

Using file.size which is not a standard attribute

Using 'is' instead of 'is not' for None check

We read the file content length, check extension membership, and ensure file is not None.

Practice

1. In Flask, which object do you use to access files uploaded by a user in a form?

easy

A. request.files

B. request.form

C. request.args

D. request.data

Solution

1. Step 1: Understand Flask request objects

   Flask provides different objects to access data sent by the client. request.files holds uploaded files.

2. Step 2: Identify correct object for file uploads

   Files sent via form with enctype='multipart/form-data' are accessed through request.files.

3. Final Answer:

   request.files -> Option A

4. Quick Check:

   File uploads = request.files [OK]

Hint: Uploaded files are in request.files, not request.form [OK]

Common Mistakes:

• Using request.form to get files
• Trying to access files via request.args
• Not using multipart/form-data in form

2. Which of the following is the correct way to check if a file was uploaded before saving it in Flask?

easy

A. if request.args.get('file')

B. if request.files['file'] is None

C. if request.form['file'] != None

D. if 'file' in request.files and request.files['file'].filename != ''

Solution

1. Step 1: Check file presence in request.files

   Use 'file' in request.files to confirm the file key exists.

2. Step 2: Ensure filename is not empty

   Check request.files['file'].filename != '' to confirm a file was selected.

3. Final Answer:

   if 'file' in request.files and request.files['file'].filename != '' -> Option D

4. Quick Check:

   Check key and filename before saving [OK]

Hint: Check both key and filename before saving file [OK]

Common Mistakes:

• Checking request.form instead of request.files
• Not verifying filename is not empty
• Using request.args for file data

3. What will be the output of this Flask route when a file named 'photo.png' is uploaded?

from flask import Flask, request
app = Flask(__name__)

@app.route('/upload', methods=['POST'])
def upload():
    f = request.files['file']
    filename = f.filename
    return f"Uploaded: {filename}"

medium

A. Uploaded: None

B. KeyError: 'file'

C. Uploaded: photo.png

D. Uploaded: ''

Solution

1. Step 1: Access file from request.files

   The code gets the file object from request.files['file'], which holds the uploaded file.

2. Step 2: Return the filename string

   The filename attribute contains the original file name, here 'photo.png', which is returned in the response.

3. Final Answer:

   Uploaded: photo.png -> Option C

4. Quick Check:

   Filename returned matches uploaded file [OK]

Hint: Filename attribute holds the uploaded file's name [OK]

Common Mistakes:

• Assuming filename is None if file exists
• Not using request.files to get file
• Forgetting to use POST method

4. Identify the error in this Flask file upload code snippet:

@app.route('/upload', methods=['POST'])
def upload():
    file = request.files['file']
    if file.filename:
        file.save('/uploads/' + file.filename)
    return 'File saved'

medium

A. Using POST method instead of GET

B. Saving file without checking if 'file' key exists in request.files

C. Missing return statement

D. Incorrect filename attribute usage

Solution

1. Step 1: Check for 'file' key in request.files

   The code accesses request.files['file'] directly without verifying if the key exists, risking a KeyError.

2. Step 2: Properly check key before accessing

   Use if 'file' in request.files before accessing to avoid errors.

3. Final Answer:

   Saving file without checking if 'file' key exists in request.files -> Option B

4. Quick Check:

   Always check key exists before accessing [OK]

Hint: Check 'file' key in request.files before accessing [OK]

Common Mistakes:

• Directly accessing request.files['file'] without check
• Assuming filename always exists
• Ignoring form enctype for file uploads

5. You want to securely save an uploaded file in Flask to a folder named 'uploads'. Which of the following is the best practice to avoid security risks?

hard

A. Use secure_filename() from werkzeug.utils before saving the file

B. Save the file directly with file.filename without changes

C. Rename the file to a fixed name like 'upload.txt' always

D. Save files outside the Flask app folder without any checks

Solution

1. Step 1: Understand filename security risks

   Using raw filenames can allow directory traversal or unsafe characters causing security issues.

2. Step 2: Use secure_filename() to sanitize filenames

   The secure_filename() function cleans the filename to a safe format before saving.

3. Final Answer:

   Use secure_filename() from werkzeug.utils before saving the file -> Option A

4. Quick Check:

   Sanitize filenames with secure_filename() [OK]

Hint: Always sanitize filenames with secure_filename() before saving [OK]

Common Mistakes:

• Saving files with user-provided names directly
• Ignoring filename sanitization
• Using fixed names causing overwrites