Form validation in django

Question

I just started to use django. I came across forms and I need to know which one is the better way to validate a forms. Would it be using django forms or should we use javascript or some client side scripting language to do it?

Solution 1

You should ALWAYS validate your form on the server side, client side validation is but a convenience for the user only.

That being said, Django forms has a variable form.errors which shows if certain form fields were incorrect.

{{ form.name_of_field.errors }} can give you each individual error of each field that's incorrectly filled out. See more here:

http://docs.djangoproject.com/en/dev/topics/forms/

Solution 2

There's a pluggable Django app (django-ajax-forms) that helps validate forms on the client side through JavaScript. But as AlbertoPL says, use client side validation only as a usability measure (e.g. telling a user that his desired username is already taken without reloading the registration page). There are all kind of ways to sidestep client side validation, in most cases as simple as deactivating JavaScript.

Generally speaking: presume all data coming from the outside as faulty until validated.

Solution 3

Just came accross django-floppyforms, which seems to do clientside validation by default. They use HTML5 which supports clientside validation by default. Not sure if they also use javascript though if the browser doesn't support HTML5. Haven't tried it myself yet.

Link to django-floppyforms: Documentation and Github

Solution 4

If you are using bootstrap then you can simply add required attribute in forms field. For example if there is programe field then you can validate it like:

In forms.py:

programme = forms.ChoiceField(course_choices,required=True, widget=forms.Select(attrs={'required':'required'}))

Note: It requires to link to bootstrap files in your .html page of that form.

View more solutions

Comments

[Venedictos]

You will get a lot more viewers with the tag django than a subtag like django-forms. Always try to include at least one tag for the main platform/language you are using (such as .net, java, django, etc.), especially when you have not hit the five tag limit.

[Steve Losh]

One thing that the docs don't mention is the existence of {{ form.non_field_errors }} for when you want to get at just the errors that apply to the form as a whole.

[AlbertoPL]

Yes, I find the docs do miss out on a lot of stuff, or they simply do not go into detail. I hope that as the framework evolves the docs do as well.

[ShawnMilo]

To reiterate what Alberto said: Client-side validation is not validation. Anyone can craft a POST or GET request. The only actual benefit you get from client-side validation is the "Web 2.0 AJAXy feel" for the user, but it's not validation -- that takes place server-side.