CSRF attack works:
Database Information
SQLALCHEMY_DATABASE_URI = 'mysql+pymysql://root:[email protected]:3306/test'
SQLALCHEMY_TRACK_MODIFICATIONS = False
Create a model:
from flask_sqlalchemy import SQLAlchemy
db = SQLAlchemy()
from exts import db
class User(db.Model):
__tablename__ = 'user'
id = db.Column(db.Integer, primary_key=True) # int类型的主键,SQLAlchemy会自动设为自增
email = db.Column(db.String(50), nullable=False)
username = db.Column(db.String(50), nullable=False)
password = db.Column(db.String(50), nullable=False)
deposit = db.Column(db.Float, default=0)
main entrance
from flask import Flask
from exts import db
import config
app = Flask(__name__)
app.config.from_object(config)
db.init_app(app)
if __name__ == '__main__':
app.run(debug=True)
manager
from flask_script import Manager
from app import app
from exts import db
from flask_migrate import Migrate, MigrateCommand
from models import User # 在此导入模型
manager = Manager(app)
Migrate(app, db)
manager.add_command('db', MigrateCommand)
if __name__ == '__main__':
manager.run()
Initialization: python manager.py db init
Generating migration scripts: python manager.py db migrate
The migration scripts mapped to the database: python manager.py db migrate
form validation
Import Form1 WTForms from, StringField, FloatField
from wtforms.validators Import In Email, the Length, EqualTo, InputRequired
class RegistForm (Form1):
In Email = StringField (validators = [In Email (Message = 'mail format error')])
username = StringField (validators = [length (3, 20, message = ' username length of 3 ~ 20')])
password = StringField (validators = [length (3, 20, message = ' username length of 3 ~ 20')])
check_password = StringField (validators = [EqualTo ( 'password', message = ' two passwords do not match')])
Deposit = FloatField (validators = [InputRequired (Message = 'disposed balance')])
Sign up view
from flask import Flask, render_template, views, request
from forms import RegistForm
from exts import db
import config
from models import User
app = Flask(__name__)
app.config.from_object(config)
db.init_app(app)
@app.route('/')
def index():
return render_template('index.html')
class RegistView(views.MethodView):
""" 注册视图 """
def get(self):
return render_template('regist.html')
def post(self):
form = RegistForm(request.form)
if form.validate():
email = form.email.data
username = form.username.data
password = form.password.data
deposit = form.deposit.data
user = User(email=email, username=username, password=password, deposit=deposit)
db.session.add(user)
db.session.commit()
return '注册成功'
else:
return f'注册失败,错误如下:{form.errors}'
app.add_url_rule('/regist/', view_func=RegistView.as_view('regist'))
if __name__ == '__main__':
app.run(debug=True)
index.html
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>银行首页</title>
</head>
<body>
<h1>欢迎来到宇宙银行</h1>
<ul>
<li><a href="{{ url_for('regist') }}">去注册</a></li>
</ul>
</body>
</html>
regist.html
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>注册页</title>
</head>
<body>
<form action="" method="post">
<table>
<tbody>
<tr>
<td>邮箱:</td>
<td><input type="text" name="email"></td>
</tr>
<tr>
<td>用户名:</td>
<td><input type="text" name="username"></td>
</tr>
<tr>
<td>密码:</td>
<td><input type="text" name="password"></td>
</tr>
<tr>
<td>确认密码:</td>
<td><input type="text" name="check_password"></td>
</tr>
<tr>
<td>设置余额:</td>
<td><input type="text" name="deposit"></td>
</tr>
<tr>
<td></td>
<td><input type="submit" value="点击注册"></td>
</tr>
</tbody>
</table>
</form>
</body>
</html>
注册两个用户