Form handling

Last reviewed Jun 1, 2026 Content v20260601

Track mode: server_script
Means: Server runner
Reading: ~1 min
Level: intermediate

This lesson

This lesson teaches Form handling: the syntax, APIs, and habits you need before advancing in Django.

The ORM is Django’s core productivity lever—N+1 queries and migration mistakes show up in every senior review.

You will apply Form handling in contexts like: Registration, login, profile settings, and permissioned workflows.

Write Python 3 in the editor and click Run on server—the dev runner executes your script; Django framework lessons also use local startproject for full MVT (LEARNING_RUNNER_ENABLED=true).

When you can explain the previous lesson's ideas without copying starter code.

Forms translate HTTP POST data into validated Python values. Django forms handle rendering, validation, and error display—whether bound to models or standalone.

Rendering in templates

<form method="post">
  {% csrf_token %}
  {{ form.as_p }}
  <button type="submit">Save</button>
</form>

Bound vs unbound

Unbound form (GET): empty fields. Bound form (POST): Form(request.POST)—call is_valid() before trusting data.

Important interview questions and answers

Q: Why csrf_token?
A: Prevents cross-site request forgery—proves POST came from your site.
Q: cleaned_data?
A: Dict of validated, normalized values after is_valid()—use this, not raw POST.
Q: File uploads?
A: Use request.FILES and enctype="multipart/form-data" on the form.

Self-check

What makes a form "bound"?
Where do validated values live after is_valid()?

Pitfall: Forgetting {% csrf_token %} yields 403 on POST—every mutating form needs it unless you use exempt (rare and risky).

Interview tip Lesson completion confidence

Can you explain this lesson in 30 seconds without reading notes?

Self-reflection (saved on this device)

Not saved yet.

Playground

Runs on the configured server runner (dev: npm run runner with LEARNING_RUNNER_ENABLED=true). Output appears below the editor.

Code runner not available

Server runner is disabled. Set LEARNING_RUNNER_ENABLED=true and LEARNING_RUNNER_URL in .env (see .env.example).

Check yourself

Multiple choice — immediate feedback.

Discussion

Past discussion is visible to everyone. Only logged-in users can post comments and replies.

Starter discussion topics

CSRF token where?
POST only forms?

No discussion yet. Be the first to ask a question.