Flask-WTF for form validation - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when a Flask-WTF form fails validation?

Consider a Flask-WTF form with a required field. What is the typical behavior when the form is submitted with that field empty?

Flask

from flask_wtf import FlaskForm
from wtforms import StringField
from wtforms.validators import DataRequired

class MyForm(FlaskForm):
    name = StringField('Name', validators=[DataRequired()])

A The form's validate_on_submit() returns False, and errors are available in form.name.errors.

B The form raises a ValidationError exception automatically and stops execution.

C The form submits successfully but the field value is set to None.

D The form ignores the missing field and proceeds without errors.

💡 Hint

Think about how Flask-WTF signals validation problems without crashing the app.

When a required field is empty, validate_on_submit() returns False. The errors are stored in the field's errors list for display.

📝 Syntax

intermediate

Which code correctly defines a Flask-WTF form with an email field that must be a valid email?

Select the code snippet that correctly uses Flask-WTF and WTForms validators to require a valid email input.

A

from flask_wtf import FlaskForm
from wtforms import StringField
from wtforms.validators import Email

class EmailForm(FlaskForm):
    email = StringField('Email', validators=[Email()])

B

from flask_wtf import FlaskForm
from wtforms import EmailField
from wtforms.validators import DataRequired

class EmailForm(FlaskForm):
    email = EmailField('Email', validators=[DataRequired()])

C

from flask_wtf import FlaskForm
from wtforms import StringField
from wtforms.validators import Email, DataRequired

class EmailForm(FlaskForm):
    email = StringField('Email', validators=[DataRequired(), Email()])

D

from flask_wtf import FlaskForm
from wtforms import StringField
from wtforms.validators import DataRequired

class EmailForm(FlaskForm):
    email = StringField('Email', validators=[DataRequired()])

💡 Hint

You need both presence and format validation for an email field.

Option C uses StringField with both DataRequired and Email validators, ensuring the field is filled and contains a valid email format.

❓ state_output

advanced

What is the value of form.username.data after submitting a form with username='Alice'?

Given this Flask-WTF form and a POST request with username='Alice', what will form.username.data contain after form.validate_on_submit()?

Flask

from flask_wtf import FlaskForm
from wtforms import StringField
from wtforms.validators import DataRequired

class UserForm(FlaskForm):
    username = StringField('Username', validators=[DataRequired()])

# Assume request.form contains {'username': 'Alice'}
form = UserForm()
valid = form.validate_on_submit()

A 'Alice'

B Raises AttributeError because data is not set

C '' (empty string)

D None

💡 Hint

If validation passes, the data attribute holds the submitted value.

After successful validation, form.username.data contains the submitted string 'Alice'.

🔧 Debug

advanced

Why does this Flask-WTF form always fail validation even with valid input?

Examine the code and identify why validate_on_submit() always returns False even when the form is submitted correctly.

Flask

from flask_wtf import FlaskForm
from wtforms import StringField
from wtforms.validators import DataRequired

class SampleForm(FlaskForm):
    field = StringField('Field', validators=[DataRequired()])

# In the route handler:
form = SampleForm()
if form.validate_on_submit():
    # process form
    pass
else:
    print(form.errors)

A The field name 'field' is a reserved keyword causing validation failure.

B DataRequired validator is deprecated and causes validation to fail.

C validate_on_submit() requires manual call to form.process() before validation.

D The form is instantiated without passing request.form, so it has no data to validate.

💡 Hint

Check how Flask-WTF gets form data from the request.

Flask-WTF's validate_on_submit() checks request.method and request.form automatically, but if the form is instantiated without the request context or without passing formdata, validation fails.

🧠 Conceptual

expert

How does Flask-WTF integrate CSRF protection in forms?

Which statement best describes how Flask-WTF adds CSRF protection to forms?

A CSRF protection is disabled by default and must be enabled by installing a separate extension.

B Flask-WTF automatically adds a hidden CSRF token field to forms and validates it on submission using the app's secret key.

C Flask-WTF requires manual addition of a CSRF token field and manual validation in the route handler.

D Flask-WTF uses JavaScript to add CSRF tokens dynamically after the form is rendered.

💡 Hint

Think about how Flask-WTF simplifies security for developers.

Flask-WTF automatically injects a hidden CSRF token field in forms and validates it on submission using the app's secret key, protecting against CSRF attacks without extra code.