Flask表单验证失效排查：未填全表单仍可提交问题

当前代码存在问题——即使五个表单字段中有任意一个未填写，表单依然会被提交，问题出在带有if not的判断行。

原代码 #

@app.route('/register', methods=['GET', 'POST'])
def register():
    if current_user.is_authenticated:
        return redirect('/dashboard')
    if request.method == 'POST':
        first = encryption.encrypt(request.form['first'])
        last = encryption.encrypt(request.form['last'])
        userEmail = encryption.encrypt(request.form['email'])
        userUsername = encryption.sha256(request.form['username'])
        userPass = encryption.sha256(request.form['password'])
        if not (first or last or userUsername or userEmail or userPass):
            msg= 'Please Fill All Of The Forms'
            return render_template('register.html')
        else:
            dupCheck = dup_check(userEmail, userPass)
            #if user already exists in database, dont allow it to be added
            if dupCheck is True:
                msg = 'Email/username already present'
                return render_template('register.html', msg=msg)
            #if user does not exist, create session to add data to db
            user = parent_user(
                email=userEmail, 
                parent_user=userUsername, 
                parent_first=first, 
                parent_last=last,
                password = userPass
                )
            db.session.add(user)
            db.session.commit()
            return redirect('/')
    return render_template('register.html')

问题分析 #

1. 逻辑判断错误：原条件if not (first or last or userUsername or userEmail or userPass)仅当所有字段都为空时才会触发提示，但实际需求是只要有一个字段为空就阻止提交。
2. 未处理空字段异常：如果表单字段未填写，直接使用request.form['xxx']会抛出KeyError，导致程序报错而非返回提示。
3. 加密时机错误：对未验证的空值进行加密操作，属于无意义的资源浪费。

修正后的代码 #

@app.route('/register', methods=['GET', 'POST'])
def register():
    if current_user.is_authenticated:
        return redirect('/dashboard')
    if request.method == 'POST':
        # 先获取原始表单数据并去除首尾空白
        first_raw = request.form.get('first', '').strip()
        last_raw = request.form.get('last', '').strip()
        email_raw = request.form.get('email', '').strip()
        username_raw = request.form.get('username', '').strip()
        password_raw = request.form.get('password', '').strip()
        
        # 检查所有字段是否都已填写
        if not all([first_raw, last_raw, email_raw, username_raw, password_raw]):
            msg = '请填写所有表单字段'
            return render_template('register.html', msg=msg)
        
        # 验证通过后再执行加密操作
        first = encryption.encrypt(first_raw)
        last = encryption.encrypt(last_raw)
        userEmail = encryption.encrypt(email_raw)
        userUsername = encryption.sha256(username_raw)
        userPass = encryption.sha256(password_raw)
        
        dupCheck = dup_check(userEmail, userPass)
        if dupCheck:
            msg = '邮箱/用户名已存在'
            return render_template('register.html', msg=msg)
        
        user = parent_user(
            email=userEmail, 
            parent_user=userUsername, 
            parent_first=first, 
            parent_last=last,
            password=userPass
        )
        db.session.add(user)
        db.session.commit()
        return redirect('/')
    return render_template('register.html')

修正说明 #

• 使用request.form.get()安全获取字段，避免未填写时抛出异常，同时用.strip()过滤空白字符，防止用户仅输入空格绕过验证。
• 用all()函数判断所有字段是否非空，符合“任一未填写则阻止提交”的需求。
• 将加密步骤移至验证之后，仅对有效数据进行加密，提升效率。

内容的提问来源于stack exchange，提问作者Sxnn