pip install Flask-WTF

# app.py
from flask import Flask, current_app, request, render_template
from forms import MyForm

app = Flask(__name__,template_folder='static/html')
@app.route('/',methods=['GET','POST'])
def login():
  form = MyForm()
  if form.validate_on_submit():
    return 'OK'
  return render_template('forms/index.html', form=form)
if __name__ == '__main__':
  app.run(host='127.0.0.1', port=80, debug=True)

# forms.py
from flask_wtf import FlaskForm
from wtforms import StringField
from wtforms.validators import DataRequired

class MyForm(FlaskForm):
  name = StringField('name', validators=[DataRequired()])

# forms/index.html
<form method="POST" action="/">
{{ form.csrf_token }}
{{ form.name.label }} {{ form.name(size=20) }}
<input type="submit" value="Go">
</form>

# core.py
__all__ = (
  'BooleanField', 'DecimalField', 'DateField', 'DateTimeField', 'FieldList',
  'FloatField', 'FormField', 'IntegerField', 'RadioField', 'SelectField',
  'SelectMultipleField', 'StringField',
)

# 參數(shù)：
class UserAdminForm(FlaskForm):
  username = StringField(label='用戶名', validators=[DataRequired(),Length(4,20)])
  password_hash = PasswordField(label='密碼',validators=[DataRequired(),Length(4,20)])
  limit = SelectField(label='用戶權(quán)限',
            choices=[('guest', '所有權(quán)限'),
                 ('operation', '可讀可寫不可刪除'),
                 ('management', '可讀不可寫')],
            default='guest') # 權(quán)限

# 字段一般的參數(shù)
# label:字段的名字
# default：默認(rèn)
# validators：字段的驗(yàn)證序列
# description：字段的描述
# choices：SelectField和他的子類有的字段，選擇框，多選一

__all__ = (
  'DataRequired', 'data_required', 'Email', 'email', 'EqualTo', 'equal_to',
  'IPAddress', 'ip_address', 'InputRequired', 'input_required', 'Length',
  'length', 'NumberRange', 'number_range', 'Optional', 'optional',
  'Required', 'required', 'Regexp', 'regexp', 'URL', 'url', 'AnyOf',
  'any_of', 'NoneOf', 'none_of', 'MacAddress', 'mac_address', 'UUID'
)

from wtforms.validators import DataRequired,Length,StopValidation
class NewStringField(StringField):
  """
  自定義一個(gè)新的字段
  """
  def pre_validate(self, form):
    """驗(yàn)證方法，在validators驗(yàn)證序列之前"""
    x:str = form.name.data
    if not x.startswith('g'):
      raise StopValidation("your data must be startswith 'g'")

  def post_validate(self, form, validation_stopped):
    """
    驗(yàn)證方法，在validators驗(yàn)證序列之后
    :param form:該字段所屬的表單對(duì)象
    :param validation_stopped:前面驗(yàn)證序列的結(jié)果，True表示驗(yàn)證通過，F(xiàn)alse表示驗(yàn)證失敗
    :return:
    """
    if not validation_stopped:
      raise ValueError("驗(yàn)證失敗了！")
    pass

def validate(self):
  """
  Validates the form by calling `validate` on each field, passing any
  extra `Form.validate_<fieldname>` validators to the field validator.
  """
  extra = {}
  for name in self._fields:
    inline = getattr(self.__class__, 'validate_%s' % name, None)
    if inline is not None:
      extra[name] = [inline]

  return super(Form, self).validate(extra)

class MyForm(FlaskForm):
  name = StringField('name', validators=[DataRequired(), Length(4,20)])
  def validate_name(self, field):
    print(field.data)
    if hasattr(self, 'name') and len(self.name.data) > 5:
      print(self.name.data)
      return True
    raise ValidationError('超過5個(gè)字符')

# 在自定義的驗(yàn)證方法中，拋出異常使用ValidationError，validate會(huì)自動(dòng)捕捉。

class FlaskForm(Form):
  class Meta(DefaultMeta):
    def wrap_formdata(self, form, formdata):
      pass

  def __init__(self, formdata=_Auto, **kwargs):
    csrf_enabled = kwargs.pop('csrf_enabled', None)
    pass
  def is_submitted(self):
    pass
  def validate_on_submit(self):
    pass
  def hidden_tag(self, *fields):
    pass
  def validate(self):
    pass

# froms.py
class UserPasswordForm(FlaskForm):
  """
  登錄提交的表單
  """
  username = StringField('User', validators=[DataRequired()])
  password = PasswordField('Password', validators=[DataRequired()])

# form.html
<form method="POST" action="/">
{{ form.csrf_token }}
{{ form.username.label }} {{ form.username(size=20) }}
{{ form.password.label }} {{ form.password }}
<input type="submit" value="Go">
</form>

# views.py
@app.route('/login',methods=['GET','POST'])
def login():
  form = UserPasswordForm()
  if form.validate_on_submit():
    # 驗(yàn)證表單
    if form.username.data == "xiaoming" and form.password.data == '123':
      return 'OK'
  return render_template('forms/index.html', form=form)

# form.py
class MyForm(FlaskForm):
  name = StringField('name', validators=[DataRequired(), Length(4,20)])
# view.py
@app.route('/form',methods=['GET','POST'])
def form():
  if request.method != "GET":
    form = MyForm() # form會(huì)獲取請(qǐng)求數(shù)據(jù)
    print(form.data)
    return 'ok'
  return ''
# test.py
import requests as req
import json

class ProTest():
  baseurl = 'http://127.0.0.1:80'
  def test_form(self):
    url = self.baseurl + '/form'
    rsp = req.post(url,json={'name':'hhhh'})
    # rsp = req.get(url,json={'name':'hhhh'})
if __name__ == '__main__':
  test = ProTest()
  test.test_form()

# 禁用保護(hù)
form = Form(csrf_enabled=False)
# 或配置app時(shí)
WTF_CSRF_ENABLED = False

from flask_wtf.csrf import CsrfProtect
csrf = CsrfProtect()

def create_app():
  app = Flask(__name__)
  csrf.init_app(app)

# 模板中添加一個(gè)隱藏域
<input type="hidden" name="csrf_token" value="{{ csrf_token() }}" />
<meta name="csrf-token" content="{{ csrf_token() }}">
# 如果是ajax請(qǐng)求，可以在腳本中
var csrftoken = "{{ csrf_token() }}"
# 然后每個(gè)請(qǐng)求添加 X-CSRFToken 頭部

# 全局禁用csrf
WTF_CSRF_CHECK_DEFAULT = False

# 對(duì)一些視圖跳過csrf檢查
@csrf.exempt
@app.route('/foo', methods=('GET', 'POST'))
def my_handler():
  return 'ok'