Forms

from flask import request, redirect, url_for, render_template, flash

@app.route("/login", methods=["GET", "POST"])
def login():
    if request.method == "POST":
        email = request.form.get("email", "").strip()
        password = request.form.get("password", "")
        if not email or not password:
            flash("All fields are required.", "error")
            return render_template("login.html"), 422
        # validate...
        return redirect(url_for("dashboard"))
    return render_template("login.html")

<!-- login.html -->
<form method="POST" action="{{ url_for('login') }}">
  <input type="email" name="email" required>
  <input type="password" name="password" required>
  <button type="submit">Log In</button>
</form>

pip install flask-wtf

# config
app.config["SECRET_KEY"] = "change-me"   # required for CSRF
app.config["WTF_CSRF_ENABLED"] = True    # default True

from flask_wtf import FlaskForm
from wtforms import StringField, PasswordField, BooleanField, SubmitField, TextAreaField, SelectField, IntegerField, FileField
from wtforms.validators import DataRequired, Email, Length, EqualTo, Optional, NumberRange, Regexp, URL, ValidationError

class LoginForm(FlaskForm):
    email    = StringField("Email",    validators=[DataRequired(), Email()])
    password = PasswordField("Password", validators=[DataRequired(), Length(min=8)])
    remember = BooleanField("Remember me")
    submit   = SubmitField("Log In")

class RegisterForm(FlaskForm):
    username = StringField("Username",
                           validators=[DataRequired(), Length(3, 20),
                                       Regexp(r"^[\w]+$", message="Letters/digits/underscore only")])
    email    = StringField("Email", validators=[DataRequired(), Email()])
    password = PasswordField("Password", validators=[DataRequired(), Length(8)])
    confirm  = PasswordField("Confirm", validators=[DataRequired(), EqualTo("password")])
    submit   = SubmitField("Register")

    def validate_email(self, field):
        """Custom per-field validator (called automatically)."""
        if db.session.scalar(select(User).where(User.email == field.data)):
            raise ValidationError("Email already registered.")

@app.route("/login", methods=["GET", "POST"])
def login():
    form = LoginForm()
    if form.validate_on_submit():      # POST + passes all validators
        user = authenticate(form.email.data, form.password.data)
        if user:
            return redirect(url_for("dashboard"))
        form.email.errors.append("Invalid credentials.")
    return render_template("login.html", form=form)

<form method="POST">
  {{ form.hidden_tag() }}    {# CSRF token — required #}

  {{ form.email.label }}
  {{ form.email(class="form-input", placeholder="you@example.com") }}
  {% for error in form.email.errors %}
    <span class="error">{{ error }}</span>
  {% endfor %}

  {{ form.password.label }}
  {{ form.password() }}

  {{ form.remember() }} {{ form.remember.label }}

  {{ form.submit(class="btn") }}
</form>

class PostForm(FlaskForm):
    category = SelectField(
        "Category",
        choices=[("tech", "Technology"), ("art", "Arts"), ("sci", "Science")],
        validators=[DataRequired()],
    )
    # Dynamic choices (set in view):
    author = SelectField("Author", coerce=int)

# In view, populate dynamic choices:
form = PostForm()
form.author.choices = [(u.id, u.name) for u in db.session.scalars(select(User))]

from flask_wtf.file import FileField, FileRequired, FileAllowed

class UploadForm(FlaskForm):
    avatar = FileField("Avatar", validators=[
        FileRequired(),
        FileAllowed(["jpg", "jpeg", "png"], "Images only."),
    ])
    submit = SubmitField("Upload")

@app.route("/upload", methods=["GET", "POST"])
def upload():
    form = UploadForm()
    if form.validate_on_submit():
        f = form.avatar.data
        from werkzeug.utils import secure_filename
        f.save(os.path.join(app.config["UPLOAD_FOLDER"],
                            secure_filename(f.filename)))
        return redirect(url_for("index"))
    return render_template("upload.html", form=form)

@app.route("/posts/<int:id>/edit", methods=["GET", "POST"])
def edit_post(id):
    post = db.get_or_404(Post, id)
    form = PostForm(obj=post)         # populate from SQLAlchemy model
    if form.validate_on_submit():
        form.populate_obj(post)       # copy form data back to model
        db.session.commit()
        return redirect(url_for("show_post", id=id))
    return render_template("edit.html", form=form)

from flask_wtf.csrf import generate_csrf

@app.context_processor
def csrf_token():
    return {"csrf_token": generate_csrf}

<meta name="csrf-token" content="{{ csrf_token() }}">

fetch("/api/items", {
  method: "POST",
  headers: {
    "X-CSRFToken": document.querySelector("meta[name=csrf-token]").content,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ name: "Widget" }),
});

from flask_wtf.csrf import CSRFProtect

csrf = CSRFProtect(app)

@app.route("/webhook", methods=["POST"])
@csrf.exempt
def webhook():
    ...

csrf.exempt(api_bp)

class AddressForm(FlaskForm):
    street = StringField("Street")
    city   = StringField("City")

class UserForm(FlaskForm):
    name    = StringField("Name")
    address = FormField(AddressForm)                      # nested form
    phones  = FieldList(StringField("Phone"), min_entries=1)  # dynamic list

# Access:
form.address.street.data
form.phones[0].data

{% for phone in form.phones %}
  {{ phone() }}
{% endfor %}
<button type="button" id="add-phone">+ Add Phone</button>

from flask import flash

@app.route("/submit", methods=["POST"])
def submit():
    form = ContactForm()
    if form.validate_on_submit():
        send_email(form.email.data, form.message.data)
        flash("Message sent!", "success")
        return redirect(url_for("index"))
    flash("Please fix the errors below.", "error")
    return render_template("contact.html", form=form), 422

{% for category, msg in get_flashed_messages(with_categories=True) %}
  <div class="alert alert-{{ category }}">{{ msg }}</div>
{% endfor %}