0
0
Flaskframework~5 mins

Flask-WTF for form validation

Choose your learning style9 modes available
LearnWhyDeepVisualTryChallengeProjectRecallPerf
Introduction

Flask-WTF helps you check if the information users type in forms is correct and safe. It makes handling forms easier and more secure.

When you want to make sure users enter valid email addresses in a signup form.
When you need to check that passwords meet certain rules before saving them.
When you want to protect your forms from bad data or attacks like CSRF.
When you want to show helpful error messages if users forget to fill required fields.
When you want to organize form code cleanly in your Flask app.
Syntax
Flask
from flask_wtf import FlaskForm
from wtforms import StringField, PasswordField, SubmitField
from wtforms.validators import DataRequired, Email, Length

class MyForm(FlaskForm):
    email = StringField('Email', validators=[DataRequired(), Email()])
    password = PasswordField('Password', validators=[DataRequired(), Length(min=6)])
    submit = SubmitField('Submit')

FlaskForm is the base class for creating forms.

Validators check if the input meets rules like being filled or having a valid email format.

Examples
A simple form with one required text field called 'Name'.
Flask
from flask_wtf import FlaskForm
from wtforms import StringField
from wtforms.validators import DataRequired

class SimpleForm(FlaskForm):
    name = StringField('Name', validators=[DataRequired()])
This form checks if the input is a valid email address.
Flask
from flask_wtf import FlaskForm
from wtforms import StringField
from wtforms.validators import Email

class EmailForm(FlaskForm):
    email = StringField('Email', validators=[Email()])
This form requires the password to be at least 8 characters long.
Flask
from flask_wtf import FlaskForm
from wtforms import PasswordField
from wtforms.validators import Length

class PasswordForm(FlaskForm):
    password = PasswordField('Password', validators=[Length(min=8)])
Sample Program

This Flask app shows a login form with email and password fields. It checks if the email is valid and the password is at least 6 characters. If the form is correct, it shows a success message.

Flask
from flask import Flask, render_template_string, request
from flask_wtf import FlaskForm
from wtforms import StringField, PasswordField, SubmitField
from wtforms.validators import DataRequired, Email, Length

app = Flask(__name__)
app.config['SECRET_KEY'] = 'secret123'

class LoginForm(FlaskForm):
    email = StringField('Email', validators=[DataRequired(), Email()])
    password = PasswordField('Password', validators=[DataRequired(), Length(min=6)])
    submit = SubmitField('Login')

form_html = '''
<!doctype html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <title>Login</title>
</head>
<body>
  <h1>Login Form</h1>
  <form method="POST">
    {{ form.hidden_tag() }}
    <p>
      {{ form.email.label }}<br>
      {{ form.email(size=32) }}<br>
      {% for error in form.email.errors %}
        <span style="color: red;">{{ error }}</span><br>
      {% endfor %}
    </p>
    <p>
      {{ form.password.label }}<br>
      {{ form.password(size=32) }}<br>
      {% for error in form.password.errors %}
        <span style="color: red;">{{ error }}</span><br>
      {% endfor %}
    </p>
    <p>{{ form.submit() }}</p>
  </form>
  {% if success %}
    <p style="color: green;">Login successful for {{ email }}!</p>
  {% endif %}
</body>
</html>
'''

@app.route('/', methods=['GET', 'POST'])
def login():
    form = LoginForm()
    success = False
    email = ''
    if form.validate_on_submit():
        email = form.email.data
        success = True
    return render_template_string(form_html, form=form, success=success, email=email)

if __name__ == '__main__':
    app.run(debug=True)
OutputSuccess
Important Notes

Always set a secret key in your Flask app to protect forms from CSRF attacks.

Use validate_on_submit() to check if the form was submitted and is valid in one step.

Flask-WTF automatically adds a hidden CSRF token field to your forms for security.

Summary

Flask-WTF makes form handling and validation simple and secure in Flask apps.

Use validators to check user input like required fields, email format, and length.

Show helpful error messages and protect forms from attacks easily.