Why HTML forms with POST method in Flask? - Purpose & Use Cases

The Big Idea

Discover how a simple change in your form can protect user secrets and power your web app!

The Scenario

Imagine building a website where users must enter their name and password to log in. You try to send this data by manually appending it to the URL every time they submit the form.

The Problem

Manually adding data to URLs is unsafe and messy. Sensitive info like passwords become visible in the address bar, and URLs get too long and confusing. Also, the server can't easily handle big or private data this way.

The Solution

Using HTML forms with the POST method sends data securely in the request body, not the URL. This keeps sensitive info hidden and lets the server receive and process user input cleanly and safely.

Before vs After

✗ Before

<form action="/login" method="GET">
  <input name="username">
  <input name="password" type="password">
  <button type="submit">Login</button>
</form>

✓ After

<form action="/login" method="POST">
  <input name="username">
  <input name="password" type="password">
  <button type="submit">Login</button>
</form>

What It Enables

It enables secure and organized data submission from users to servers, making interactive web apps possible.

Real Life Example

When you sign up for a new account on a website, the form uses POST to safely send your info like email and password to create your profile.

Key Takeaways

Manual URL data sending exposes sensitive info and is limited.

POST method sends data securely in the request body.

HTML forms with POST make user input handling safe and easy.

Practice

1. What does the POST method in an HTML form do in a Flask application?

easy

A. Automatically encrypts the form data before sending

B. Sends form data appended to the URL as query parameters

C. Prevents the form from submitting data

D. Sends form data inside the request body, not visible in the URL

Solution

1. Step 1: Understand HTTP methods in forms

   The POST method sends data inside the request body, keeping it hidden from the URL.

2. Step 2: Compare with GET method

   The GET method appends data to the URL, but POST does not, making it safer for sensitive data.

3. Final Answer:

   Sends form data inside the request body, not visible in the URL -> Option D

4. Quick Check:

   POST hides data in request body [OK]

Hint: POST sends data hidden in body, not URL [OK]

Common Mistakes:

• Confusing POST with GET method
• Thinking POST encrypts data automatically
• Believing POST prevents form submission

2. Which of the following is the correct way to specify a form that sends data using POST in HTML?

easy

A. ...

B. ...

C. ...

D. ...

Solution

1. Step 1: Identify the correct attribute for HTTP method

   The method attribute in the form tag defines how data is sent.

2. Step 2: Confirm correct value for POST

   Setting method='post' correctly configures the form to send data via POST.

3. Final Answer:

   <form method='post'>...</form> -> Option A

4. Quick Check:

   Use method='post' in form tag [OK]

Hint: Use method='post' attribute in form tag [OK]

Common Mistakes:

• Using 'action' instead of 'method' for HTTP method
• Writing method='get' when POST is needed
• Using non-standard attributes like 'send'

3. Given this Flask route and form, what will be printed when the form is submitted?

from flask import Flask, request
app = Flask(__name__)

@app.route('/submit', methods=['POST'])
def submit():
    name = request.form.get('name')
    return f'Hello, {name}!'

Send

medium

A. Hello, !

B. Hello, Alice!

C. Error: name not found

D. Hello, request.form!

Solution

1. Step 1: Understand form submission with POST

   The form sends the input named 'name' with value 'Alice' to the '/submit' route via POST.

2. Step 2: Check how Flask reads form data

   The route uses request.form.get('name') to get the value 'Alice' from the form data.

3. Final Answer:

   Hello, Alice! -> Option B

4. Quick Check:

   request.form.get('name') returns 'Alice' [OK]

Hint: request.form.get('name') reads POST form data [OK]

Common Mistakes:

• Using request.args instead of request.form for POST data
• Not specifying methods=['POST'] in route
• Missing the 'name' attribute in input

4. What is wrong with this Flask route that handles a POST form submission?

from flask import Flask, request
app = Flask(__name__)

@app.route('/login')
def login():
    username = request.form['username']
    return f'Welcome {username}'

medium

A. The route does not allow POST method, so form data won't be received

B. request.form['username'] should be request.args['username']

C. The route should use GET method instead of POST

D. Flask requires form data to be accessed via request.data

Solution

1. Step 1: Check route methods

   The route only allows GET by default, but form data sent by POST won't be processed.

2. Step 2: Confirm correct method usage

   To handle POST form data, the route must include methods=['POST'].

3. Final Answer:

   The route does not allow POST method, so form data won't be received -> Option A

4. Quick Check:

   Route must allow POST to read POST form data [OK]

Hint: Add methods=['POST'] to route decorator [OK]

Common Mistakes:

• Forgetting to add methods=['POST'] in route
• Using request.args for POST data
• Trying to access form data via request.data

5. You want to create a Flask route that accepts a POST form with fields 'username' and 'password'. It should return 'Login successful' only if username is 'admin' and password is 'secret', otherwise 'Login failed'. Which code snippet correctly implements this?

hard

A. from flask import Flask, request
app = Flask(__name__)

@app.route('/login', methods=['GET'])
def login():
user = request.form['username']
pwd = request.form['password']
if user == 'admin' and pwd == 'secret':
return 'Login successful'
else:
return 'Login failed'

B. from flask import Flask, request
app = Flask(__name__)

@app.route('/login')
def login():
user = request.args.get('username')
pwd = request.args.get('password')
if user == 'admin' and pwd == 'secret':
return 'Login successful'
else:
return 'Login failed'

C. from flask import Flask, request
app = Flask(__name__)

@app.route('/login', methods=['POST'])
def login():
user = request.form.get('username')
pwd = request.form.get('password')
if user == 'admin' and pwd == 'secret':
return 'Login successful'
else:
return 'Login failed'

D. from flask import Flask, request
app = Flask(__name__)

@app.route('/login', methods=['POST'])
def login():
user = request.form['username']
if user == 'admin':
return 'Login successful'
else:
return 'Login failed'

Solution

1. Step 1: Ensure route accepts POST method

   The route must specify methods=['POST'] to handle form POST data.

2. Step 2: Correctly read both 'username' and 'password' from request.form

   Use request.form.get() to safely get both fields and check their values.

3. Step 3: Implement correct login logic

   Return 'Login successful' only if both username and password match expected values; otherwise return 'Login failed'.

4. Final Answer:

   The code with methods=['POST'], request.form.get() for both fields, and checks both credentials -> Option C

5. Quick Check:

   from flask import Flask, request app = Flask(__name__) @app.route('/login', methods=['POST']) def login(): user = request.form.get('username') pwd = request.form.get('password') if user == 'admin' and pwd == 'secret': return 'Login successful' else: return 'Login failed' [OK]

Hint: Use methods=['POST'] and request.form.get for form fields [OK]

Common Mistakes:

• Using GET method instead of POST
• Reading form data from request.args
• Checking only username without password