Django Forms & Validation

Web forms are the primary vector for user input and data mutation in web applications. Writing manual HTML forms and raw validation logic in views leads to security vulnerabilities (such as SQL injection, XSS, and unvalidated payloads). Django's Form framework provides declarative form definitions, automatic HTML widget rendering, server-side data cleaning and validation, and tight integration with models via ModelForm.

1. Declarative Forms vs ModelForms

• forms.Form: Used for arbitrary input processing not tied directly to a single database table (e.g. contact forms, password reset requests, search filters).
• forms.ModelForm: Automatically maps fields from a Django model, inferring validation rules, field types, and default widgets while providing an automatic .save() method.

2. Implementing an Enterprise ModelForm

3. Handling Forms in Views

The canonical pattern for processing form submissions:

4. The Critical commit=False and save_m2m() Rule

When using form.save(commit=False), Django instantiates the model object without writing to the database, allowing you to attach additional attributes (like author).

However, Many-to-Many relationships cannot be saved until the parent object has a database ID. Therefore, after calling article.save(), you must call form.save_m2m() to persist tags or related categories!