**Course Title:** Mastering Flask Framework: Building Modern Web Applications **Section Title:** Forms and User Input Handling **Topic:** Creating and validating forms with Flask-WTF **Introduction** In this topic, we'll explore the Flask-WTF extension, which provides support for working with forms in a Flask application. You'll learn how to create and validate forms using Flask-WTF, and how to ensure secure handling of user input. **What is Flask-WTF?** Flask-WTF is a Flask extension that provides a simple way to handle form data and validation in Flask applications. It's built on top of WTForms, a popular Python library for handling forms. **Installing Flask-WTF** To install Flask-WTF, run the following command in your terminal: ```bash pip install Flask-WTF ``` **Creating a Form** To create a form with Flask-WTF, you'll need to define a form class that inherits from `FlaskForm`. Here's an example of a simple form that includes a name and email field: ```python from flask_wtf import FlaskForm from wtforms import StringField, EmailField, SubmitField from wtforms.validators import DataRequired class MyForm(FlaskForm): name = StringField('Name', validators=[DataRequired()]) email = EmailField('Email', validators=[DataRequired()]) submit = SubmitField('Submit') ``` In this example, we define a `MyForm` class that includes three fields: `name`, `email`, and `submit`. We use the `DataRequired` validator to ensure that the name and email fields are not empty. **Validating a Form** To validate a form, you'll need to create an instance of the form class and pass in the form data. You can then check if the form is valid using the `validate_on_submit` method. Here's an example of how to validate a form in a Flask route: ```python @app.route('/submit', methods=['GET', 'POST']) def submit_form(): form = MyForm() if form.validate_on_submit(): name = form.name.data email = form.email.data # Do something with the form data return 'Form submitted successfully!' return render_template('submit_form.html', form=form) ``` In this example, we create an instance of the `MyForm` class and pass in the form data. We then check if the form is valid using the `validate_on_submit` method. If the form is valid, we extract the form data and do something with it. Otherwise, we render an error message. **Rendering a Form** To render a form in a Flask template, you'll need to pass the form instance to the template. Here's an example of how to render a form in a Jinja2 template: ```jinja <form method="POST"> {{ form.hidden_tag() }} {{ form.name.label }} {{ form.name() }} {{ form.email.label }} {{ form.email() }} {{ form.submit() }} </form> ``` In this example, we use the `hidden_tag` method to render any hidden fields in the form. We then render each field in the form using the `label` and `()` methods. **Takeaways** * Flask-WTF is a powerful extension for handling forms in Flask applications. * Forms can be validated using the `validate_on_submit` method. * Forms can be rendered in Jinja2 templates using the `hidden_tag` method and field-specific methods. **Further Reading** * [Flask-WTF documentation](https://flask-wtf.readthedocs.io/en/stable/) * [WTForms documentation](https://wtforms.readthedocs.io/en/stable/) **Comments or Questions?** Leave a comment below if you have any questions or feedback about this topic. We'll discuss handling user input securely in the next topic. Next: [Handling user input securely](#).