Handling Form Data in Flask (GET vs POST)<\/strong><\/h2>\n\n\n\nWith the HTML form ready, you now need a Flask route to display it and another to handle what’s submitted. Open app.py<\/code> and add this:<\/p>\n\n\n\nfrom flask import Flask, render_template, request\n\napp = Flask(__name__)\n\n@app.route('\/')\ndef form():\n return render_template('form.html')\n\n@app.route('\/submit', methods=['POST'])\ndef submit():\n name = request.form['name']\n email = request.form['email']\n return f\"Thanks, {name}! We received your email: {email}\"\n\nif __name__ == '__main__':\n app.run(debug=True)\n<\/code><\/pre>\n\n\n\nThe first route simply renders the form when someone visits the homepage. The second route, \/submit<\/code>, only accepts POST<\/code> requests, which matches the method we set in the HTML form. Inside this route, request.form['name']<\/code> and request.form['email']<\/code> pull the actual values the user typed in, using the same name<\/code> attributes defined in the HTML.<\/p>\n\n\n\nIt’s worth understanding why POST matters here. GET requests append data to the URL, which isn’t suitable for anything sensitive, like passwords or personal details. POST keeps that data inside the request body, out of the URL entirely, making it the correct choice for form submissions.<\/p>\n\n\n\n
<\/p>\n\n\n\n
Displaying Submitted Data on Another Page<\/strong><\/h2>\n\n\n\nRight now, the submitted data just shows up as plain text. A cleaner approach is to render it on a separate HTML page. Create a new file, templates\/result.html<\/code>:<\/p>\n\n\n\n<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n <title>Submission Result<\/title>\n<\/head>\n<body>\n <h2>Thank you, {{ name }}!<\/h2>\n <p>We've received your email: {{ email }}<\/p>\n<\/body>\n<\/html>\n<\/code><\/pre>\n\n\n\nThen update the \/submit<\/code> route in app.py<\/code> to render this page instead of returning plain text:<\/p>\n\n\n\n@app.route('\/submit', methods=['POST'])\ndef submit():\n name = request.form['name']\n email = request.form['email']\n return render_template('result.html', name=name, email=email)\n<\/code><\/pre>\n\n\n\nImportant Note:<\/strong><\/p>\n\n\n\nNotice the double curly braces in result.html<\/code>, like {{ name }}<\/code>. This is Jinja2 syntax, Flask’s built-in templating engine, and it’s how Python variables get inserted directly into your HTML.<\/p>\n\n\n\n<\/p>\n\n\n\n
Adding Server-Side Validation<\/strong><\/h2>\n\n\n\nClient-side validation, like the required<\/code> attribute in your HTML input, is helpful, but it can be bypassed easily. Anyone can disable JavaScript or send a request directly, skipping your form entirely. That’s why server-side validation matters.<\/p>\n\n\n\nHere’s a simple way to add it:<\/p>\n\n\n\n
@app.route('\/submit', methods=['POST'])\ndef submit():\n name = request.form.get('name', '').strip()\n email = request.form.get('email', '').strip()\n\n if not name or not email:\n return \"Name and email are required.\", 400\n\n return render_template('result.html', name=name, email=email)\n<\/code><\/pre>\n\n\n\nUsing .get()<\/code> instead of direct dictionary access avoids errors if a field is missing entirely, and the check right after makes sure empty submissions don’t slip through. This small addition makes your form noticeably more reliable.<\/p>\n\n\n\n<\/p>\n\n\n\n
Securing Your HTML Form in Flask with CSRF Protection<\/strong><\/h2>\n\n\n\nThis is the part most beginner tutorials skip entirely, but it matters a lot once your form handles real user data. Without protection, your form can be vulnerable to CSRF (Cross-Site Request Forgery) attacks, where a malicious site tricks a user’s browser into submitting a form on your site without their knowledge.<\/p>\n\n\n\n
The standard way to fix this in Flask is using Flask-WTF<\/strong>, an extension that adds CSRF protection automatically. First, install it:<\/p>\n\n\n\npip install flask-wtf<\/code><\/pre>\n\n\n\nThen update app.py<\/code> to include a secret key, which Flask-WTF needs to generate CSRF tokens:<\/p>\n\n\n\napp.config['SECRET_KEY'] = 'your-secret-key-here'<\/code><\/pre>\n\n\n\nAnd in your HTML form, add a hidden CSRF token field:<\/p>\n\n\n\n
<form action=\"\/submit\" method=\"POST\">\n <input type=\"hidden\" name=\"csrf_token\" value=\"{{ csrf_token() }}\">\n ...\n<\/form><\/code><\/pre>\n\n\n\nThis token gets validated automatically on submission, and if it’s missing or doesn’t match, Flask-WTF blocks the request. It’s a small addition, but it’s the difference between a form that works and a form that’s actually safe to use in production.<\/p>\n\n\n\n
<\/p>\n\n\n\n
Common Mistakes to Avoid<\/strong><\/h2>\n\n\n\nA few mistakes come up repeatedly when people are just starting out with an HTML form in Flask<\/strong>:<\/p>\n\n\n\n\n- Forgetting the
name<\/code> attribute:<\/strong> Without it, request.form<\/code> has no way to identify the field, and you’ll get a KeyError.<\/li>\n\n\n\n- Mismatched form method:<\/strong> If your HTML form uses
POST<\/code> but your Flask route only allows GET<\/code>, Flask will return a 405 error.<\/li>\n\n\n\n- Placing HTML files outside the templates folder:<\/strong>
render_template()<\/code> won’t find your file, and you’ll get a TemplateNotFound error.<\/li>\n\n\n\n- Skipping server-side validation:<\/strong> Relying only on HTML’s
required<\/code> attribute leaves your form open to bad or missing data.<\/li>\n\n\n\n- Ignoring CSRF protection:<\/strong> Fine for practice projects, but a real risk once your form is live and handling actual user input.<\/li>\n<\/ol>\n\n\n\n
<\/p>\n\n\n\n
Conclusion<\/strong><\/h2>\n\n\n\nBuilding an HTML form in Flask starts simple, an HTML file, a route, and a bit of Python to read what’s submitted. But going from a working example to something production-ready means adding validation and CSRF protection along the way. Once you’ve built one form this way, the same pattern applies to pretty much any form you’ll build in Flask going forward, login pages, contact forms, feedback systems, all of it.<\/p>\n\n\n\n
<\/p>\n\n\n\n
FAQs<\/strong><\/h2>\n\n\n\n
\n
\n
1. How do I create a form in HTML Flask?<\/h3>\n\n\n
Build the form in an HTML file inside the templates folder, then render it using render_template()<\/code> in your Flask route. This is how you create a html form in flask.<\/p>\n\n<\/div>\n<\/div>\n\n
2. How to get form data in Flask?<\/h3>\n\n\n
Use request.form['field_name']<\/code> inside your route to access whatever the user typed into that input field.<\/p>\n\n<\/div>\n<\/div>\n\n
3. Is GET or POST used for forms in Flask?<\/h3>\n\n\n
POST is used for form submissions since it keeps data in the request body instead of exposing it in the URL.<\/p>\n\n<\/div>\n<\/div>\n
\n
4. How do I display form data in Flask?<\/h3>\n\n\n
Pass the submitted data into render_template()<\/code> and use Jinja2’s {{ }}<\/code> syntax to show it on another page.<\/p>\n\n<\/div>\n<\/div>\n\n
5. Do I need Flask-WTF to build an HTML form in Flask?<\/h3>\n\n\n
No, it’s optional for basic forms, but recommended for CSRF protection and validation in production.<\/p>\n\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n
<\/p>\n\n\n\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
To create a basic HTML form in Flask, you build the form in an HTML file, then use a Flask route to read and process what the user submits. That’s the whole idea in one line, but getting it working properly and doing it the right way takes a few more steps. In this guide, […]<\/p>\n","protected":false},"author":64,"featured_media":137463,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[37,718],"tags":[],"views":"24489","authorinfo":{"name":"Abhishek Pati","url":"https:\/\/www.guvi.in\/blog\/author\/abhishek-pati\/"},"thumbnailURL":"https:\/\/www.guvi.in\/blog\/wp-content\/uploads\/2021\/04\/How-to-Create-an-HTML-Form-in-Flask-300x116.png","_links":{"self":[{"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/posts\/3777"}],"collection":[{"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/users\/64"}],"replies":[{"embeddable":true,"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/comments?post=3777"}],"version-history":[{"count":65,"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/posts\/3777\/revisions"}],"predecessor-version":[{"id":137473,"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/posts\/3777\/revisions\/137473"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/media\/137463"}],"wp:attachment":[{"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/media?parent=3777"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/categories?post=3777"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/tags?post=3777"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}