Validation checks submitted input before the application accepts or processes it. A login form, for example, must handle missing values, length violations, and malformed email addresses rather than trusting user input. section 8.2.2
A practical validation routine can check:
- Whether required fields are present. section 8.2.2
- Whether values fit length restrictions and standardized formats. section 8.2.2
- Whether a value satisfies an application-specific rule, such as an email address not already existing in the database. section 8.4.2
from flask_wtf import FlaskForm #1
from wtforms import PasswordField, #2
BooleanField, SubmitField #2
from wtforms.fields.html5 import EmailField #2
from wtforms.validators import DataRequired, #3
Length, Email, EqualTo #3
class LoginForm(FlaskForm): #4
email = EmailField( #5
"Email", #5
validators=[DataRequired(), Length( #5
min=4, #5
max=128, #5
message="Email must be between 4 #5
and 128 characters long" #5
), Email()], #5
render_kw={"placeholder": " "} #5
) #5
password = PasswordField( #6
"Password", #6
validators=[DataRequired(), Length( #6
min=3, #6
max=64, #6
message="Password must be between 3 #6
and 64 characters long" #6
)], #6
render_kw={"placeholder": “ “} #6
) #6
remember_me = BooleanField(" Keep me logged in") #7
cancel = SubmitField( #8
label="Cancel", #8
render_kw={"formnovalidate": True}, #8
) #8
submit = SubmitField("Log In") #9
A Flask-WTF form binds server-side fields to HTML elements and assigns reusable validators to each field. section 8.2.2
Form libraries centralize these checks and expose the result through form validation. Custom validators can query application data and raise a validation error, while templates display field-specific messages. Handlers then proceed only when validation succeeds; otherwise they return feedback instead of creating invalid records. section 8.4.2 section 11.8.3
Validating a comment submission
A comment handler creates a form, calls validate_on_submit(), and saves the stripped comment only when validation passes. If validation fails, it flashes a message and redirects without creating a post. section 11.8.3
