Day19 Django之Form表单验证、CSRF、Cookie、Session和Model操作

一、Form表单验证

用于做用户提交数据的验证
1.自定义规则

a、自定义规则（类，字段名==html中的name值）
b、数据提交-规则进行匹配
代码如下：

"""day19_django URL Configuration

The `urlpatterns` list routes URLs to views. For more information please see:
    https://docs.djangoproject.com/en/1.10/topics/http/urls/
Examples:
Function views
    1. Add an import:  from my_app import views
    2. Add a URL to urlpatterns:  url(r'^$', views.home, name='home')
Class-based views
    1. Add an import:  from other_app.views import Home
    2. Add a URL to urlpatterns:  url(r'^$', Home.as_view(), name='home')
Including another URLconf
    1. Import the include() function: from django.conf.urls import url, include
    2. Add a URL to urlpatterns:  url(r'^blog/', include('blog.urls'))
"""
from django.conf.urls import url
from django.contrib import admin
from app01 import views

urlpatterns = [
    url(r'^admin/', admin.site.urls),
    url(r'^login/', views.login),
]

urls.py

"""
Django settings for day19_django project.

Generated by 'django-admin startproject' using Django 1.10.2.

For more information on this file, see
https://docs.djangoproject.com/en/1.10/topics/settings/

For the full list of settings and their values, see
https://docs.djangoproject.com/en/1.10/ref/settings/
"""

import os

# Build paths inside the project like this: os.path.join(BASE_DIR, ...)
BASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))

# Quick-start development settings - unsuitable for production
# See https://docs.djangoproject.com/en/1.10/howto/deployment/checklist/

# SECURITY WARNING: keep the secret key used in production secret!
SECRET_KEY = 'pv#lfw8ywtf=ws8mr%f9b)ihc0s@oj-2$wu^2o@)+(^)$i_9*n'

# SECURITY WARNING: don't run with debug turned on in production!
DEBUG = True

ALLOWED_HOSTS = []

# Application definition

INSTALLED_APPS = [
    'django.contrib.admin',
    'django.contrib.auth',
    'django.contrib.contenttypes',
    'django.contrib.sessions',
    'django.contrib.messages',
    'django.contrib.staticfiles',
    'app01',
]

MIDDLEWARE = [
    'django.middleware.security.SecurityMiddleware',
    'django.contrib.sessions.middleware.SessionMiddleware',
    'django.middleware.common.CommonMiddleware',
    'django.middleware.csrf.CsrfViewMiddleware',
    'django.contrib.auth.middleware.AuthenticationMiddleware',
    'django.contrib.messages.middleware.MessageMiddleware',
    'django.middleware.clickjacking.XFrameOptionsMiddleware',
]

ROOT_URLCONF = 'day19_django.urls'

TEMPLATES = [
    {
        'BACKEND': 'django.template.backends.django.DjangoTemplates',
        'DIRS': [os.path.join(BASE_DIR, 'templates')]
        ,
        'APP_DIRS': True,
        'OPTIONS': {
            'context_processors': [
                'django.template.context_processors.debug',
                'django.template.context_processors.request',
                'django.contrib.auth.context_processors.auth',
                'django.contrib.messages.context_processors.messages',
            ],
        },
    },
]

WSGI_APPLICATION = 'day19_django.wsgi.application'

# Database
# https://docs.djangoproject.com/en/1.10/ref/settings/#databases

DATABASES = {
    'default': {
        'ENGINE': 'django.db.backends.sqlite3',
        'NAME': os.path.join(BASE_DIR, 'db.sqlite3'),
    }
}

# Password validation
# https://docs.djangoproject.com/en/1.10/ref/settings/#auth-password-validators

AUTH_PASSWORD_VALIDATORS = [
    {
        'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator',
    },
    {
        'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator',
    },
    {
        'NAME': 'django.contrib.auth.password_validation.CommonPasswordValidator',
    },
    {
        'NAME': 'django.contrib.auth.password_validation.NumericPasswordValidator',
    },
]

# Internationalization
# https://docs.djangoproject.com/en/1.10/topics/i18n/

LANGUAGE_CODE = 'en-us'

TIME_ZONE = 'UTC'

USE_I18N = True

USE_L10N = True

USE_TZ = True

# Static files (CSS, JavaScript, Images)
# https://docs.djangoproject.com/en/1.10/howto/static-files/

STATIC_URL = '/static/'
STATICFILES_DIRS = (
    os.path.join(BASE_DIR, 'static'),
)

settings.py

from django.shortcuts import render,HttpResponse
from django import forms
from django.forms.utils import ErrorDict
import json
from django.core.exceptions import ValidationError
import re

def mobile_validate(value):
    mobile_re = re.compile(r'^(13[0-9]|15[012356789]|17[678]|18[0-9]|14[57])[0-9]{8}$')
    if not mobile_re.match(value):
        raise ValidationError('手机号码格式错误')

class LoginForm(forms.Form):
    user = forms.CharField(required=True, error_messages={'required':'用户名不能为空'})
    pwd = forms.CharField(required=True,
                          min_length=6,
                          max_length=12,
                          error_messages={'required':'密码必须不能为空',
                                          'min_length':'至少6位',
                                          'max_length':'最多12位'})
    num = forms.IntegerField(error_messages={'required':'数字不能为空', 'invalid':'必须输入数字'})
    #url = forms.EmailField()
    phone = forms.CharField(validators=[mobile_validate, ],)

def login(request):
    if request.method == 'POST':
        result = {'status':False, 'message':None}
        obj = LoginForm(request.POST)
        ret = obj.is_valid()
        if ret:
            print(obj.clean())
            result['status'] = True
        else:
            print(type(obj.errors), obj.errors.as_json())
            error_str = obj.errors.as_json()
            result['message'] = json.loads(error_str)
            return HttpResponse(json.dumps(result))
    return render(request, 'login.html')

views.py

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Title</title>
    <style>
        .error-msg{
            background-color: red;
        }
    </style>
</head>
<body>
    <div>
        <div>
            <input type="text" name="user" />
        </div>
        <div>
            <input type="text" name="num" />
        </div>
        <div>
            <input type="text" name="phone" />
        </div>
        <div>
            <input type="password" name="pwd" />
        </div>
        <input type="button" value="提交" onclick="DoSubmit();" />
    </div>
    <script src="/static/jquery-1.12.4.js"></script>
    <script>
        function DoSubmit() {
            var dict_input = {};
            $('input').each(function () {
                var v = $(this).val();
                var n = $(this).attr('name');
                dict_input[n] = v;
            });
            console.log(dict_input);
            $('.error-msg').remove();
            $.ajax({
                url:'/login/',
                type:'POST',
                data:dict_input,
                dataType: 'json',
                success:function (result) {
                    if(result.status){
                        location.href = '/index/';
                    }else{
                        $.each(result.message, function (k, v) {
                            console.log(k, v[0].message);
                            //<sapn class="error-msg">错误信息</span>
                            var tag = document.createElement('span');
                            tag.className = 'error-msg';
                            tag.innerText = v[0].message;
                            //input[name="user"]
                            $('input[name="' + k + '"]').after(tag);
                        })
                    }

                },
                error:function () {

                }
            })
        }
    </script>
</body>
</html>

login.html

2.用于做用户提交数据的验证 + 生成HTML标签

代码如下：

from django.shortcuts import render,HttpResponse
from django import forms
from django.forms.utils import ErrorDict
import json
from django.core.exceptions import ValidationError
import re

def mobile_validate(value):
    mobile_re = re.compile(r'^(13[0-9]|15[012356789]|17[678]|18[0-9]|14[57])[0-9]{8}$')
    if not mobile_re.match(value):
        raise ValidationError('手机号码格式错误')

class LoginForm(forms.Form):
    user = forms.CharField(required=True, error_messages={'required':'用户名不能为空'})
    pwd = forms.CharField(required=True,
                          min_length=6,
                          max_length=12,
                          error_messages={'required':'密码必须不能为空',
                                          'min_length':'至少6位',
                                          'max_length':'最多12位'})
    num = forms.IntegerField(error_messages={'required':'数字不能为空', 'invalid':'必须输入数字'})
    #url = forms.EmailField()
    phone = forms.CharField(validators=[mobile_validate, ],)
    #生成input标签，并加属性，设置样式
    #test = forms.CharField(widget=forms.TextInput(attrs={'k1':'123','class':'error-msg'}))
    #生成下拉列表,真正提交数据还是数字
    test_choices = {
        (0, '上海'),
        (1, '北京'),
    }
    test = forms.IntegerField(widget=forms.Select(choices=test_choices))
def login(request):
    if request.POST:
        objPost = LoginForm(request.POST)
        ret = objPost.is_valid()
        if ret:
            print(objPost.clean())
        else:
            #obj1.errors是ErrorDict，ErrorDict继承dict
            # for k,v in objPost.errors.items():
            #     print(k, v)
            # print(objPost.errors['phone'][0])
            # print(objPost.errors['user'][0])
            # print(objPost.errors['num'][0])
            pass
        return render(request, 'login.html', {'obj1': objPost})
    else:
        objGet = LoginForm()
        return render(request, 'login.html', {'obj1':objGet})

views.py

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Title</title>
    <style>
        .error-msg{
            background-color: red;
        }
    </style>
</head>
<body>
    <form action="/login/" method="POST">
        <div>
            <div>
                {{ obj1.user }}
                {% if obj1.errors.user %}
                    <span class="error-msg">{{ obj1.errors.user.0 }}</span>
                {% endif %}
            </div>
            <div>
                {{ obj1.pwd }}
                {% if obj1.errors.pwd %}
                    <span class="error-msg">{{ obj1.errors.pwd.0 }}</span>
                {% endif %}
            </div>
            <div>
               {{ obj1.num }}
                {% if obj1.errors.num %}
                    <span class="error-msg">{{ obj1.errors.num.0 }}</span>
                {% endif %}
            </div>
            <div>
               {{ obj1.phone }}
                {% if obj1.errors.phone %}
                    <span class="error-msg">{{ obj1.errors.phone.0 }}</span>
                {% endif %}
            </div>
            <div>
                {{ obj1.test }}
            </div>
            <input type="submit" value="提交" />
        </div>
    </form>
</body>
</html>

login.html

二、CSRF

django为用户实现防止跨站请求伪造的功能，通过中间件 django.middleware.csrf.CsrfViewMiddleware 来完成。而对于django中设置防跨站请求伪造功能有分为全局和局部。

全局：

　　中间件 django.middleware.csrf.CsrfViewMiddleware

局部：

• @csrf_protect，为当前函数强制设置防跨站请求伪造功能，即便settings中没有设置全局中间件。
• @csrf_exempt，取消当前函数防跨站请求伪造功能，即便settings中设置了全局中间件。

注：from django.views.decorators.csrf import csrf_exempt,csrf_protect

"""day19_django URL Configuration

The `urlpatterns` list routes URLs to views. For more information please see:
    https://docs.djangoproject.com/en/1.10/topics/http/urls/
Examples:
Function views
    1. Add an import:  from my_app import views
    2. Add a URL to urlpatterns:  url(r'^$', views.home, name='home')
Class-based views
    1. Add an import:  from other_app.views import Home
    2. Add a URL to urlpatterns:  url(r'^$', Home.as_view(), name='home')
Including another URLconf
    1. Import the include() function: from django.conf.urls import url, include
    2. Add a URL to urlpatterns:  url(r'^blog/', include('blog.urls'))
"""
from django.conf.urls import url
from django.contrib import admin
from app01 import views

urlpatterns = [
    url(r'^admin/', admin.site.urls),
    url(r'^login/', views.login),
    url(r'^csrf/', views.csrf),
]

urls.py

from django.shortcuts import render,HttpResponse
from django import forms
from django.forms.utils import ErrorDict
import json
from django.core.exceptions import ValidationError
import re

def mobile_validate(value):
    mobile_re = re.compile(r'^(13[0-9]|15[012356789]|17[678]|18[0-9]|14[57])[0-9]{8}$')
    if not mobile_re.match(value):
        raise ValidationError('手机号码格式错误')

class LoginForm(forms.Form):
    user = forms.CharField(required=True, error_messages={'required':'用户名不能为空'})
    pwd = forms.CharField(required=True,
                          min_length=6,
                          max_length=12,
                          error_messages={'required':'密码必须不能为空',
                                          'min_length':'至少6位',
                                          'max_length':'最多12位'})
    num = forms.IntegerField(error_messages={'required':'数字不能为空', 'invalid':'必须输入数字'})
    #url = forms.EmailField()
    phone = forms.CharField(validators=[mobile_validate, ],)
    #生成input标签，并加属性，设置样式
    #test = forms.CharField(widget=forms.TextInput(attrs={'k1':'123','class':'error-msg'}))
    #生成下拉列表,真正提交数据还是数字
    test_choices = {
        (0, '上海'),
        (1, '北京'),
    }
    test = forms.IntegerField(widget=forms.Select(choices=test_choices))
def login(request):
    if request.POST:
        objPost = LoginForm(request.POST)
        ret = objPost.is_valid()
        if ret:
            print(objPost.clean())
        else:
            #obj1.errors是ErrorDict，ErrorDict继承dict
            # for k,v in objPost.errors.items():
            #     print(k, v)
            # print(objPost.errors['phone'][0])
            # print(objPost.errors['user'][0])
            # print(objPost.errors['num'][0])
            pass
        return render(request, 'login.html', {'obj1': objPost})
    else:
        objGet = LoginForm()
        return render(request, 'login.html', {'obj1':objGet})

def csrf(request):
    return render(request, 'csrf.html')

views.py

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Title</title>
</head>
<body>
        <!--form提交-->
        <form action="/csrf/" method="POST">
            {% csrf_token %}
            <input type="text" name="v" />
            <input type="submit" value="提交" />
        </form>

    <input type="button" value="Ajax提交" onclick="DoAjax();" />
    <!--ajax提交-->
    <script src="/static/jquery-2.1.4.min.js"></script>
    <script src="/static/jquery.cookie.js"></script>
    <script>
        //获取cookie
        var csrftoken = $.cookie('csrftoken');

        function csrfSafeMethod(method) {
            // these HTTP methods do not require CSRF protection
            return (/^(GET|HEAD|OPTIONS|TRACE)$/.test(method));
        }
        $.ajaxSetup({
            beforeSend: function(xhr, settings) {
                if (!csrfSafeMethod(settings.type) && !this.crossDomain) {
                    xhr.setRequestHeader("X-CSRFToken", csrftoken);
                }
            }
        });

        function DoAjax() {
            $.ajax({
                url:'/csrf/',
                type:'POST',
                data:{'k1':'v1'},
                success: function (data) {
                    console.log(data);
                }
            })
        }
    </script>
</body>
</html>

csrf.html

三、Cookie和Session

Cookie保存在客户端浏览器上的一个容器，独立存在
服务器上保存的是session（内存或数据库或缓存），依赖Cookie

"""day19_django URL Configuration

The `urlpatterns` list routes URLs to views. For more information please see:
    https://docs.djangoproject.com/en/1.10/topics/http/urls/
Examples:
Function views
    1. Add an import:  from my_app import views
    2. Add a URL to urlpatterns:  url(r'^$', views.home, name='home')
Class-based views
    1. Add an import:  from other_app.views import Home
    2. Add a URL to urlpatterns:  url(r'^$', Home.as_view(), name='home')
Including another URLconf
    1. Import the include() function: from django.conf.urls import url, include
    2. Add a URL to urlpatterns:  url(r'^blog/', include('blog.urls'))
"""
from django.conf.urls import url
from django.contrib import admin
from app01 import views

urlpatterns = [
    url(r'^admin/', admin.site.urls),
    url(r'^login/', views.login),
    url(r'^csrf/', views.csrf),
    url(r'^cookie/', views.cookie),
    url(r'^cookie1/', views.cookie),
    url(r'^log/', views.log),
    url(r'^index/', views.index),
    url(r'^session_login/', views.session_login),
    url(r'^session_index/', views.session_index),
    url(r'^session_logout/', views.session_logout),
]

urls.py

from django.shortcuts import render,HttpResponse,redirect
from django import forms
from django.forms.utils import ErrorDict
import json
from django.core.exceptions import ValidationError
import re
from django.views.decorators.csrf import csrf_exempt,csrf_protect
def mobile_validate(value):
    mobile_re = re.compile(r'^(13[0-9]|15[012356789]|17[678]|18[0-9]|14[57])[0-9]{8}$')
    if not mobile_re.match(value):
        raise ValidationError('手机号码格式错误')

class LoginForm(forms.Form):
    user = forms.CharField(required=True, error_messages={'required':'用户名不能为空'})
    pwd = forms.CharField(required=True,
                          min_length=6,
                          max_length=12,
                          error_messages={'required':'密码必须不能为空',
                                          'min_length':'至少6位',
                                          'max_length':'最多12位'})
    num = forms.IntegerField(error_messages={'required':'数字不能为空', 'invalid':'必须输入数字'})
    #url = forms.EmailField()
    phone = forms.CharField(validators=[mobile_validate, ],)
    #生成input标签，并加属性，设置样式
    #test = forms.CharField(widget=forms.TextInput(attrs={'k1':'123','class':'error-msg'}))
    #生成下拉列表,真正提交数据还是数字
    test_choices = {
        (0, '上海'),
        (1, '北京'),
    }
    test = forms.IntegerField(widget=forms.Select(choices=test_choices))
def login(request):
    if request.POST:
        objPost = LoginForm(request.POST)
        ret = objPost.is_valid()
        if ret:
            print(objPost.clean())
        else:
            #obj1.errors是ErrorDict，ErrorDict继承dict
            # for k,v in objPost.errors.items():
            #     print(k, v)
            # print(objPost.errors['phone'][0])
            # print(objPost.errors['user'][0])
            # print(objPost.errors['num'][0])
            pass
        return render(request, 'login.html', {'obj1': objPost})
    else:
        objGet = LoginForm()
        return render(request, 'login.html', {'obj1':objGet})

#@csrf_protect 强制给函数加csrf验证

@csrf_exempt
#不用做csrf验证
def csrf(request):

    return render(request, 'csrf.html')

#使用Cookie做登录认证
def cookie(request):
    print(request.COOKIES)
    obj =  render(request, 'cookie.html')
    #path='/cookie/'，Cookie存放路径
    obj.set_cookie('k3','v3',path='/cookie/')
    return obj

def cookie1(request):
    print(request.COOKIES)
    obj =  render(request, 'cookie.html')
    #path='/'，Cookie全局生效
    obj.set_cookie('k1','v1',path='/')
    return obj

def log(request):
    if request.method == 'POST':
        u = request.POST.get('user')
        p = request.POST.get('pwd')
        if u == 'alex' and p == '':
            print(u)
            red = redirect('/index/')
            red.set_cookie('username', u)
            return red
        else:
            return render(request, 'log.html')
    else:
        return render(request, 'log.html')

def index(request):
    user = request.COOKIES.get('username')
    if user:
        return render(request, 'index.html', {'user':user})
    else:
        return redirect('/log/')

#使用session做登录认证
USER_LIST = ['alex','eric','wang','liu']
def session_login(request):
    if request.method == 'POST':
        u = request.POST.get('user')
        p = request.POST.get('pwd')
        if u in USER_LIST and p == '':
            request.session['user'] = u
            return redirect('/session_index/')
    return render(request, 'session_login.html')

"""
def session_index(request):
    user = request.session.get('user', None)
    if not user:
        return redirect('/session_login/')
    else:
        return render(request, 'session_index.html', {'user':user})
"""
def auth(func):
    def inner(request, *args, **kwargs):
        #print(request, args, kwargs)
        user = request.session.get('user', None)
        if not user:
            return redirect('/session_login/')
        return func(request, *args, **kwargs)
    return inner

@auth
def session_index(request):
    user = request.session.get('user', None)
    return render(request, 'session_index.html', {'user':user})

@auth
def session_logout(request):
    del request.session['user']
    return redirect('/session_login/')

views.py

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title></title>
</head>
<body>
    <form action="/session_login/"  method="POST">
        <input type="text" name="user">
        <input type="text" name="pwd">
        <input type="submit" value="提交" />
    </form>
</body>
</html>

session_login.html

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title></title>
</head>
<body>
    <form action="/session_login/"  method="POST">
        <input type="text" name="user">
        <input type="text" name="pwd">
        <input type="submit" value="提交" />
    </form>
</body>
</html>

session_index.html

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title></title>
</head>
<body>
    <form action="/log/"  method="POST">
        <input type="text" name="user">
        <input type="text" name="pwd">
        <input type="submit" value="提交" />
    </form>
</body>
</html>

log.html

四、Model操作

a.基本
    b.进阶
    c.双下划线
    __大于小于操作
    __可以跨表

    class UserInfo(models.Model):
        user = models.CharField(max_length=32)
        pwd = models.CharField(max_length=32)
    queryset = UserInfo.objects.all()

    print(queryset.query)       --SQL语句
    [UserInfo对象,UserInfo对象,UserInfo对象,]

    queryset = UserInfo.objects.all().values('user')
    [{'user':'alex'},{'user':'eric'}]

    queryset = UserInfo.objects.all().value_list('user')
    [('alex'),('eric')]

    =======================================================
    一对多
     class UserType(models.Model):
        caption = models.CharField(max_length=32)
    #超级管理员、普通用户、访客、黑客

     class UserInfo(models.Model):
        user = models.CharField(max_length=32)
        pwd = models.CharField(max_length=32)
        user_type = models.ForeignKey('UserType')
        #user_type_id

    #创建UserInfo
    1、UserInfo.objects.create(user='alex',pwd='',user_type=UserType.objects.get(id=2))
    或：
    2、UserInfo.objects.create(user='alex',pwd='',user_type_id=2)

    #查询
    UserInfo.objects.filter(user='alex')
        1、查询所有用户类型为普通用户的所有用户名和密码
        uid = UserType.objects.get(caption='普通用户').id
        UserInfo.objects.filter(user_type_id=uid)
        或：
        queryset = UserInfo.objects.filter(user_type__caption='普通用户')     --  跨表使用双下划线
        [UserInfo对象,UserInfo对象,UserInfo对象,]
        row = queryset[0]
        row.user
        row.pwd
        row.user_type   -- user_type对象
        row.user_type.id
        row.user_type.caption
        ###### objects __
        ###### row.外键字段.外键表的字段

        queryset = UserInfo.objects.filter(user_type__caption='普通用户').values('user', 'user_type__caption')     --  跨表使用双下划线
        [{'user':'alex','user_type__caption':'普通用户'},{'user':'eric','user_type__caption':'普通用户'}]
        row = queryset[0]
        row['user']
        row['user_type__caption']

    多张表
    class Something(models.Model):
        name = models.CharField(max_length=32)

    class UserType(models.Model):
        caption = models.CharField(max_length=32)
        st = models.ForeignKey('Something')
    #超级管理员、普通用户、访客、黑客

     class UserInfo(models.Model):
        user = models.CharField(max_length=32)
        pwd = models.CharField(max_length=32)
        user_type = models.ForeignKey('UserType')
        #user_type_id

     UserInfo.objects.filter(user_type__st__name='xx')