Saving uploaded files in Flask - Step-by-Step Execution

Concept Flow - Saving uploaded files

User selects file in form

↓

Form submitted to Flask route

↓

Flask receives file in request.files

↓

Check if file exists and is allowed

Yes↓

Save file to server folder

↓

Return success response to user

No↓

Return error response to user

This flow shows how a user uploads a file via a form, Flask receives it, checks it, saves it, and responds.

Execution Sample

Flask

from flask import Flask, request
app = Flask(__name__)

@app.route('/upload', methods=['POST'])
def upload():
    file = request.files.get('file')
    if file is None or file.filename == '':
        return 'No file selected'
    file.save('/path/to/save/' + file.filename)
    return 'File saved!'

This code receives an uploaded file from a form and saves it to a folder on the server.

Execution Table

Step	Action	Evaluation	Result
1	User submits form with file	File included in request.files	File object received
2	Access file from request.files['file']	File object exists	File object stored in variable
3	Call file.save('/path/to/save/' + file.filename)	Path is valid	File saved to server folder
4	Return response	Response sent	User sees 'File saved!' message
5	If no file or invalid	File object missing or invalid	Return error response

💡 File saved successfully or error returned if file missing/invalid

Variable Tracker

Variable	Start	After Step 2	After Step 3	Final
file	None	File object from request.files	File object remains	File object remains

Key Moments - 3 Insights

What happens if the file is not included in the request?

At step 2 in the execution_table, if request.files['file'] does not exist, the code should handle this case to avoid errors, usually by returning an error response.

Why do we use file.filename when saving?

At step 3, file.filename provides the original name of the uploaded file to save it with the same name on the server.

Can we save the file anywhere on the server?

No, the path must be valid and writable by the Flask app, as shown in step 3. Saving outside allowed folders can cause errors or security issues.

Visual Quiz - 3 Questions

Look at the execution_table, what variable holds the uploaded file after step 2?

A request

B file

C filename

D save

💡 Hint

Check the 'Variable' column in variable_tracker after step 2

At which step does the file get saved to the server folder?

A Step 3

B Step 2

C Step 1

D Step 4

💡 Hint

Look at the 'Action' and 'Result' columns in execution_table

If the file is missing in the request, what should happen according to the flow?

A Ignore and continue

B Save an empty file

C Return an error response

D Crash the server

💡 Hint

See the 'No' branch in concept_flow and step 5 in execution_table

Concept Snapshot

Saving uploaded files in Flask:
- Use request.files['file'] to get the file
- Check file exists before saving
- Use file.save(path) to save on server
- Return response after saving
- Handle missing or invalid files gracefully

Full Transcript

This visual execution shows how Flask handles saving uploaded files. First, the user selects a file and submits the form. Flask receives the file in request.files. The code checks if the file exists. If yes, it saves the file to a server folder using file.save with the original filename. Then it returns a success message. If the file is missing or invalid, it returns an error. Variables like 'file' hold the uploaded file object. Key points include checking file presence to avoid errors and saving files only to valid paths. The execution table traces each step from receiving the file to saving and responding.

Practice

1. In Flask, which object do you use to access files uploaded by a user in a form?

easy

A. request.args

B. request.files

C. request.data

D. request.form

Solution

1. Step 1: Understand Flask request objects

   Flask provides different objects to access data sent by the client. request.files holds uploaded files.

2. Step 2: Identify correct object for files

   request.form is for form fields, request.data is raw data, and request.args is for URL query parameters.

3. Final Answer:

   request.files -> Option B

4. Quick Check:

   Uploaded files = request.files [OK]

Hint: Uploaded files are always in request.files [OK]

Common Mistakes:

• Using request.form to get files
• Trying to access files from request.args
• Confusing request.data with files

2. Which of the following is the correct way to save an uploaded file named file to a folder called uploads in Flask?

easy

A. file.save('uploads/' + file.filename)

B. file.save(file.filename)

C. save(file, 'uploads/')

D. request.save(file, 'uploads/')

Solution

1. Step 1: Use the file object's save method

   The uploaded file object has a save() method that takes the full path to save the file.

2. Step 2: Provide correct path including folder and filename

   Concatenate the folder path and the file's filename to save it in the right place.

3. Final Answer:

   file.save('uploads/' + file.filename) -> Option A

4. Quick Check:

   Use file.save(path) with full path [OK]

Hint: Use file.save('folder/' + file.filename) to save files [OK]

Common Mistakes:

• Calling save() without a path
• Using save() as a standalone function
• Not including folder path in save()

3. What will happen when this Flask code runs after a file upload?

file = request.files['photo']
file.save('/tmp/' + file.filename)
return 'Saved!'

medium

A. Nothing is saved because request.files['photo'] is empty by default

B. The file is saved but the filename is lost, causing an error

C. The code raises an error because save() needs a full absolute path

D. The uploaded file is saved in /tmp/ with its original filename and 'Saved!' is returned

Solution

1. Step 1: Access the uploaded file from request.files

   The code gets the file named 'photo' from the uploaded files correctly.

2. Step 2: Save the file to /tmp/ folder with original filename

   Calling save() with '/tmp/' + filename saves the file in that folder.

3. Final Answer:

   The uploaded file is saved in /tmp/ with its original filename and 'Saved!' is returned -> Option D

4. Quick Check:

   save() stores file at given path, returns confirmation [OK]

Hint: save() stores file at given path, returns confirmation [OK]

Common Mistakes:

• Assuming save() needs absolute path always
• Thinking request.files['photo'] is empty without upload
• Confusing save() behavior with form data saving

4. Identify the error in this Flask code snippet for saving an uploaded file:

file = request.files['file']
file.save(file.filename)

medium

A. Missing folder path in save() can cause files to save in wrong location

B. Using request.files instead of request.form causes error

C. file.save() requires a file object, not a filename string

D. file.filename is not a valid attribute of the file object

Solution

1. Step 1: Check the save() method argument

   The code saves the file using only the filename, without specifying a folder path.

2. Step 2: Understand file saving location

   Without a folder path, the file saves in the current working directory, which may be unintended or insecure.

3. Final Answer:

   Missing folder path in save() can cause files to save in wrong location -> Option A

4. Quick Check:

   Always include folder path in save() [OK]

Hint: Always include folder path in save() to control file location [OK]

Common Mistakes:

• Not specifying folder path in save()
• Confusing request.files with request.form
• Assuming file.filename is invalid

5. You want to securely save an uploaded file in Flask to the uploads folder, avoiding unsafe filenames. Which code snippet correctly achieves this?

from werkzeug.utils import secure_filename
file = request.files['file']
filename = secure_filename(file.filename)
file.save(f'uploads/{filename}')

hard

A. The code will fail because secure_filename() returns a file object, not a string

B. secure_filename() is unnecessary; file.save() cleans filenames automatically

C. This code safely saves the file with a cleaned filename in uploads folder

D. You must manually create the uploads folder before saving, or it errors

Solution

1. Step 1: Use secure_filename to clean the filename

   The function secure_filename() removes unsafe characters to prevent security issues.

2. Step 2: Save the file with the cleaned filename in the uploads folder

   Using file.save() with the cleaned filename inside the uploads folder saves the file securely.

3. Final Answer:

   This code safely saves the file with a cleaned filename in uploads folder -> Option C

4. Quick Check:

   Use secure_filename() before saving uploaded files [OK]

Hint: Use secure_filename() to avoid unsafe file names [OK]

Common Mistakes:

• Skipping secure_filename and risking unsafe filenames
• Assuming save() cleans filenames automatically
• Not creating uploads folder before saving