How do Django forms work?

Question

Accepted Answer

Django **forms** handle the full lifecycle of user input: rendering HTML form fields, **validating** submitted data, and converting it to clean Python values. They abstract away the tedious, error-prone work of manual input handling and validation — a major productivity and security feature. ## A basic form ```python from django import forms class ContactForm(forms.Form): name = forms.CharField(max_length=100) email = forms.EmailField() # validates email format age = forms.IntegerField(min_value=0, required=False) message = forms.CharField(widget=forms.Textarea) ``` Each form field declares its type and validation rules. The form can render itself as HTML and validate input against those rules. ## Handling a form in a view (the standard pattern) ```python def contact(request): if request.method == "POST": form = ContactForm(request.POST) # bind submitted data if form.is_valid(): # run validation # cleaned_data = validated, type-converted Python values name = form.cleaned_data["name"] send_email(form.cleaned_data) return redirect("success") else: form = ContactForm() # empty form for GET return render(request, "contact.html", {"form": form}) ``` The key methods: `is_valid()` runs validation, and on success `cleaned_data` gives you safe, validated, type-converted values. On failure, the form retains the input and collects error messages. ## ModelForms — forms from models (DRY) ```python from django.forms import ModelForm class ArticleForm(ModelForm): class Meta: model = Article # build the form FROM a model fields = ["title", "body", "published"] # which fields to include # ModelForm can SAVE directly to the database def create(request): form = ArticleForm(request.POST) if form.is_valid(): form.save() # creates/updates the model instance! ``` **ModelForms** generate a form automatically from a model's fields and can save directly to the database — embodying DRY (the model drives the form), eliminating boilerplate for CRUD forms. ## Custom validation ```python class SignupForm(forms.Form): password = forms.CharField() confirm = forms.CharField() def clean_password(self): # field-level validation pw = self.cleaned_data["password"] if len(pw) < 8: raise forms.ValidationError("Too short") return pw def clean(self): # form-level (cross-field) validation data = super().clean() if data.get("password") != data.get("confirm"): raise forms.ValidationError("Passwords don't match") ``` ## Rendering and security ```html ``` Forms integrate with Django's **CSRF protection** (`{% csrf_token %}`) and auto-render fields with their validation errors. ## Why it matters Django forms are a core feature for handling user input safely and productively — and handling input correctly is both ubiquitous (nearly every app has forms) and security-critical. Understanding forms is essential because they abstract the tedious, error-prone work of input handling: rendering HTML fields, **validating** data against rules, converting it to clean typed Python values (`cleaned_data`), preserving input and surfacing errors on failure, and protecting against attacks. The validation aspect is especially important for **security and robustness** — forms ensure you never trust raw user input, catching malformed or malicious data before it reaches your business logic. **ModelForms** are a major productivity win, embodying DRY by generating forms directly from models and saving to the database with minimal code — eliminating boilerplate for the extremely common case of CRUD forms. Knowing the standard view pattern (`is_valid()` + `cleaned_data`), how to add custom field-level and cross-field validation, ModelForms for model-backed forms, and the integration with **CSRF protection** is fundamental for building any Django application that accepts user input. Forms tie together input handling, validation, security, and the model layer, making them an important, frequently-used part of the framework and a key reason Django is so productive for data-entry-heavy applications.