Table of Contents

Flask By Example

Credits

About the Author

Acknowledgements

About the Reviewers

www.PacktPub.com

eBooks, discount offers, and more

Why subscribe?

Preface

What this book covers

What you need for this book

Who this book is for

Conventions

Reader feedback

Customer support

Downloading the example code

Downloading the color images of this book

Errata

Piracy

Questions

1. Hello, World!

Introducing Flask

Creating our development environment

Installing pip

Installing Flask

Writing Hello, World!

Writing the code

Running the code

Deploying our application to production

Setting up a Virtual Private Server

Configuring our server

Installing and using Git

Serving our Flask app with WSGI

Configuring Apache to serve our Flask application

Summary

2. Getting Started with Our Headlines Project

Setting up our project and a Git repository

Creating a new Flask application

Introduction to RSS and RSS feeds

Using RSS from Python

URL routing in Flask

Publishing our Headlines application

Summary

3. Using Templates in Our Headlines Project

Introducing Jinja

Basic use of Jinja templates

Rendering a basic template

Passing dynamic data to our template

Displaying dynamic data in our template

Advanced use of Jinja templates

Using Jinja objects

Adding looping logic to our template

Adding hyperlinks to our template

Pushing our code to the server

Summary

4. User Input for Our Headlines Project

Getting user input using HTTP GET

Getting user input using HTTP POST

Creating a branch in Git

Adding POST routes in Flask

Making our HTML form use POST

Reverting our Git repository

Adding weather and currency data

Introducing the OpenWeatherMap API

Signing up with OpenWeatherMap

Retrieving your OpenWeatherMap API key

Parsing JSON with Python

Introducing JSON

Retrieving and parsing JSON in Python

Using our weather code

Displaying the weather data

Allowing the user to customize the city

Adding another search box to our template

Using the user's city search in our Python code

Checking our new functionality

Handling duplicate city names

Currency

Getting an API key for the Open Exchange Rates API

Using the Open Exchange Rates API

Using our currency function

Displaying the currency data in our template

Adding inputs for the user to select currency

Creating an HTML select drop-down element

Adding all the currencies to the select input

Displaying the selected currency in the drop-down input

Summary

5. Improving the User Experience of Our Headlines Project

Adding cookies to our Headlines application

Using cookies with Flask

Setting cookies in Flask

Retrieving cookies in Flask

Writing the fallback logic to check for cookies

Retrieving the cookies for other data

Adding CSS to our Headlines application

External, internal, and inline CSS

Adding our first CSS

Adding padding to our CSS

Adding more styles to our CSS

Adding the div tags to the template file

Styling our inputs

Summary

6. Building an Interactive Crime Map

Setting up a new Git repository

Understanding relational databases

Installing and configuring MySQL on our VPS

Installing MySQL on our VPS

Installing Python drivers for MySQL

Creating our Crime Map database in MySQL

Creating a database setup script

Creating the database

Looking at our table columns

Indexing and committing

Using the database setup script

Adding credentials to our setup script

Running our database setup script

Creating a basic database web application

Setting up our directory structure

Looking at our application code

Looking at our SQL code

Reading data

Inserting data

Deleting data

Creating our view code

Running the code on our VPS

Mitigating against SQL injection

Injecting SQL into our database application

Mitigating against SQL injection

Summary

7. Adding Google Maps to Our Crime Map Project

Running a database application locally

Creating a mock of our database

Adding a test flag

Writing the mock code

Validating our expectations

Adding an embedded Google Maps widget to our application

Adding the map to our template

Introducing JavaScript

The body of our HTML code

Testing and debugging

Making our map interactive

Adding markers

Using a single marker

Adding an input form for new crimes

The HTML code for the form

Adding external CSS to our web application

Creating the CSS file in our directory structure

Adding CSS code

Configuring Flask to use CSS

Viewing the result

Publishing the result

Linking the form to the backend

Setting up the URL to collect POST data

Adding the database methods

Testing the code on the server

Displaying existing crimes on our map

Getting data from SQL

Passing the data to our template

Using the data in our template

Viewing the results

Summary

8. Validating User Input in Our Crime Map Project

Choosing where to validate

Identifying inputs that require validation

Trying out an XSS example

The potential of persistent XSS

Validating and sanitizing

White and blacklisting

Validating versus sanitizing

Implementing validation

Validating the category

Validating the location

Validating the date

Validating the description

Summary

9. Building a Waiter Caller App

Setting up a new Git repository

Setting up the new project locally

Setting up the project on our VPS

Using Bootstrap to kick-start our application

Introducing Bootstrap

Downloading Bootstrap

Bootstrap templates

Adding user account control to our application

Introducing Flask-Login

Installing and importing Flask-Login

Using Flask extensions

Adding a restricted route

Authenticating a user

Creating a user class

Mocking our database for users

Logging in a user

Adding imports and configuration

Adding the login functionality

Writing the login function

Creating the load_user function

Checking the login functionality

Logging out a user

Registering a user

Managing passwords with cryptographic hashes

Python hashlib

Reversing hashes

Salting passwords

Implementing secure password storage in Python

Creating the PasswordHelper class

Updating our database code

Updating our application code

Summary

10. Template Inheritance and WTForms in Waiter Caller Project

Adding the Account and Dashboard pages

Introducing Jinja templates

Creating the base template

Creating the dashboard template

Creating the account template

Creating the home template

Adding the routing code

Creating restaurant tables

Writing the restaurant table code

Adding the create table form

Adding the create table route

Adding the create table database code

Adding the view table database code

Modifying the account route to pass table data

Modifying the template to show the tables

Adding the delete table route to our backend code

Testing the restaurant table code

Shortening URLs using the bitly API

Introducing Bitly

Using the bitly API

Getting a bitly oauth token

Creating the bitlyhelper file

Using the bitly module

Adding functionality to handle attention requests

Writing the attention request code

Adding the attention request route

Adding the attention request database code

Add the get and delete methods for attention requests

Modifying the dashboard route to use attention requests

Modifying the template code to display attention requests

Adding the resolve request application code

Testing the attention request code

Auto-refreshing the dashboard page

Adding user feedback with WTForms

Introducing WTForms

Installing Flask-WTF

Creating the registration form

Rendering the registration form

Updating the application code

Updating the template code

Testing the new form

Using WTForms in our application code

Displaying errors to our user

Displaying the errors in our template

Adding CSS for the errors

Testing the final registration form

Adding a successful registration notification

Passing the message from the application code

Using the message in the template code

Modifying the login form

Creating the new LoginForm in the application code

Using the new LoginForm in the template

Modifying the create table form

Summary

11. Using MongoDB with Our Waiter Caller Project

Introducing MongoDB

Installing MongoDB

Using the MongoDB shell

Starting the MongoDB shell

Running commands in the MongoDB shell

Creating data with MongoDB

Reading data with MongoDB

Updating data with MongoDB

Deleting data with MongoDB

Introducing PyMongo

Writing the DBHelper class

Adding the user methods

Adding the table methods

Adding the request methods

Changing the application code

Testing our application in production

Adding some finishing touches

Adding indices to MongoDB

Where do we add indices?

Adding a favicon

Summary

A. A Sneak Peek into the Future

Expanding the projects

Adding a domain name

Adding HTTPS

E-mail confirmation for new registrations

Google Analytics

Scalability

Expanding your Flask knowledge

VirtualEnv

Flask Blueprints

Flask extensions

Flask-SQLAlchemy

Flask MongoDB extensions

Flask-MongoAlchemy

Flask-PyMongo

Flask-MongoEngine

Flask-Mail

Flask-Security

Other Flask extensions

Expanding your web development knowledge

Summary

Index

Flask By Example

Flask By Example

Copyright © 2016 Packt Publishing

All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, without the prior written permission of the publisher, except in the case of brief quotations embedded in critical articles or reviews.

Every effort has been made in the preparation of this book to ensure the accuracy of the information presented. However, the information contained in this book is sold without warranty, either express or implied. Neither the author, nor Packt Publishing, and its dealers and distributors will be held liable for any damages caused or alleged to be caused directly or indirectly by this book.

Packt Publishing has endeavored to provide trademark information about all of the companies and products mentioned in this book by the appropriate use of capitals. However, Packt Publishing cannot guarantee the accuracy of this information.

First published: March 2016

Production reference: 1220316

Published by Packt Publishing Ltd.

Livery Place

35 Livery Street

Birmingham B3 2PB, UK.

ISBN 978-1-78528-693-3

www.packtpub.com

Credits

Author

Gareth Dwyer

Reviewers

Burhan Khalid

Kyle Roux

Rahul Shelke

Commissioning Editor

Julian Ursell

Acquisition Editor

Kevin Colaco

Content Development Editor

Kajal Thapar

Technical Editors

Kunal Chaudhari

Ravikiran Pise

Copy Editors

Shruti Iyer

Sonia Mathur

Project Coordinator

Shweta H Birwatkar

Proofreader

Safis Editing

Indexer

Rekha Nair

Graphics

Disha Haria

Production Coordinator

Melwyn D'sa

Cover Work

Melwyn D'sa

About the Author

Gareth Dwyer first heard the phrase, behind every no-entry sign there is a door, a couple of decades ago, and he has been looking for a counterexample ever since. He hasn't found one yet. Gareth grew up with his three siblings in Grahamstown, South Africa. There wasn't much there except some highly respected schools and a small university. Gareth had heard that school was an unpleasant and largely pointless experience, so he opted to skip it and go to the university instead. The university door had a no-entry sign on the door because it only accepted people who had gone to school. Gareth ignored the sign. He studied piano for a while but soon, he wondered if there was more to life than sitting in front of a keyboard all day. So he switched from piano to computer science, and it took him a while to realize the irony. He studied philosophy too because it was here that people never told him to stop being so argumentative.

Gareth noticed the disparagement that his philosophy and computer science departments felt towards each other, and he found it strange. He soon discovered that he wasn't the first person to see that there was room for some common ground, and he went to Europe to study computational linguistics, where he found other people who liked debating the finer points of language while talking about the three hardest problems of computer science (naming things, and off-by-one errors).

In between doodling on blank paper while listening to very knowledgeable people lecture on content that was occasionally fascinating but often soporific, Gareth has gained so-called industry experience with companies such as Amazon Web Services in Cape Town and MWR InfoSecurity in Johannesburg. He has several years' experience in writing, and his favorite languages are English and Python.

He discovered that writing and writing a book are not fully overlapping experiences, and the former is hardly preparation for the latter. The pages that follow would not have come into existence without the combined efforts of many people.

Acknowledgements

Thank you Neeshma and Kajal; you have been so very kind and patient in spite of my disrespect for deadlines. Your feedback on each chapter while I was writing and your suggestions that I try to keep to schedule have been invaluable. Thank you to everyone else at Packt Publishing who has been involved in this book, from its idea, through editing, through layout, through marketing, and all the nitty-gritty parts that the reader will never think about. I'm looking forward to the next one already.

Thank you Alisa for listening, even when I complained about writing, and even when I was still complaining a year later.

Thank you Theresa, Stephanie, and Lewis for ensuring I don't go completely sane.

Thank you to all the lecturers and tutors at Rhodes University who contributed to what I know and who I am.

Thank you Ron for teaching me how to string words together, and how commas work, and why some sentences sound nice and others don't.

Finally, thank you Mom and Dad for teaching me everything else.

About the Reviewers

Burhan Khalid has always been tinkering with technology, from his early days on the XT to writing JCL on the ISPF editor, and from C and C++, Java, Pascal, and COBOL to his latest favorite, Python. As a lover of technology, he is most comfortable experimenting with the next big technology stack.

By day, he works in a multinational bank in the Alternative Channels unit, where he gets to hack on, develop, and test applications that help execute transactions across all manner of electronic devices and channels. In addition to his work, he also contributes to open source projects, having released a few toolkits for transaction processing, and he offers consultancy services to startups on their technology stacks and development processes.

He is an avid volunteer; he is a mentor for Sirdab Lab (a startup accelerator), a frequent speaker at the local Google Developer's Group, a presenter and volunteer at StartupQ8 (a startup community), and an active user on StackOverflow.

You can reach him on Twitter @burhan

I would like to thank my mother and father for always encouraging me, my wife for putting up with my long days at the keyboard and my ever-growing gadget collection, and my friends and colleagues for providing me with new challenges to sharpen my skills.

Rahul Shelke is a cofounder of My Cute Office Pvt. Ltd. and Qpeka Technologies Pvt. Ltd. He also acts as an adviser for two other startups, and he helps startups in their growth.

Prior to starting his own venture, Rahul worked with Blisstering solutions for more than two years as a senior developer.

He is an MTech in computer science. His practical experience for the last five years has been in web development, cloud computing, business intelligence, system performance optimization, and software architecture design and development.

He has been actively involved in open source contributions since graduation, and he has contributed to Python, Python-Flask, and Drupal.

First, I would like to thank the Packt Publishing team, Shweta H. Birwatkar, and Gareth Dwyer, for giving me the opportunity to be a part of this project.

A special thanks to My Cute Office team whose support helped me manage work along with this book review. I would also like to thank my family for supporting me during this process.

Finally, thanks to the countless support from Python-Flask's open source community for providing me with such an easy and fast web development framework.

www.PacktPub.com

eBooks, discount offers, and more

Did you know that Packt offers eBook versions of every book published, with PDF and ePub files available? You can upgrade to the eBook version at www.PacktPub.com and as a print book customer, you are entitled to a discount on the eBook copy. Get in touch with us at for more details.

At www.PacktPub.com, you can also read a collection of free technical articles, sign up for a range of free newsletters and receive exclusive discounts and offers on Packt books and eBooks.

https://www2.packtpub.com/books/subscription/packtlib

Do you need instant solutions to your IT questions? PacktLib is Packt's online digital book library. Here, you can search, access, and read Packt's entire library of books.

Why subscribe?

Fully searchable across every book published by Packt

Copy and paste, print, and bookmark content

On demand and accessible via a web browser

To Ron Hall, who taught me how to write

Preface

In theory, nothing works, but everyone knows why. In practice, everything works but no one knows why. Here, we combine theory and practice; nothing works and no one knows why!

Learning computer science must always be a combination of theory and practice; you need to know what you're doing (theory), but you also need to know how to do it (practice). My experience of learning how to create web applications was that few teachers found a sweet spot for this balance; either I read pages and pages about inheritance, virtual environments, and test-driven development, wondering how it all applied to me, or I installed a bunch of tools and frameworks and libraries and watched the magic happen with no idea how it worked.

What follows is, I hope, a good balance. From the first chapter, you'll have a Flask web application running that the whole world can visit, which is quite practical even if it doesn't do anything but greet visitors with Hello, World!. In the chapters that follow, we'll walk through building three interesting and useful projects together. In general, we'll build things ourselves wherever possible. While it's not good to reinvent the wheel, it is good to be exposed to a problem before you're exposed to the solution. Learning a CSS framework before you write a single line of CSS leaves you in a confused state, in which you would wonder, But why do I actually need this?, and the same goes for many other frameworks and tools. So, we'll start from scratch, take a look at why it's difficult, and then introduce tools to make our lives easier. I think this is the ideal balance between theory and practice.

When I told people I was writing a book on Flask, the common response was Why? There are already so many books and tutorials on Flask. This is a valid question, and the answer to it provides a nice outline for what to expect from this book. Flask By Example is different from other Flask educational material and here's why.

We won't leave you stranded

Many Flask tutorials show you how to develop a Flask application and run it locally on your own machine, and then they end. This is great as a first step, but if you're interested in building web applications, you probably want them to be accessible on the Web so that your friends, family, coworkers, and customers can admire your handiwork without popping by your house. From our first project onward, our applications will run on a Virtual Private Server (VPS) and be accessible to the world.

We won't build a blogging application

If you've read any web application development tutorials, you must have noticed that nearly every one of them is about how to build a blog using x and y. I'm pretty tired of the blog example (actually, I never want to see anyone show me how to build a blog again). Instead, you'll create some interesting, original, and possibly even useful projects while learning how to develop web applications with Flask.

We will focus on security

Cybercrime has become something of a buzzword of late. Arguably, the reason that we read about major web applications being hacked on an almost daily basis is because so many developers do not know about SQL Injection, CSRF, XSS, how to store passwords, and so many other things that should really be considered basic knowledge. As we develop the three projects in this book, we'll take the time to explain some core security concepts in detail and show you how to harden our applications against potentially malicious attackers.

We will give in-depth explanations

We won't just give you some code and tell you to run it. Wherever possible, we will explain what we're doing, why we're doing it, and how we're doing it. This means that you'll be able to take ideas from all of the projects, combine them with your own ideas, and get started with building original content right after working through this book.

Therefore, I hope that this book will be of use to you, no matter whether you are beginning to cut your teeth in the world of computer science and programming or have a computer science degree from a famous university and have compiler theory pouring out of your ears but now want to build something practical and fun. May you have as much fun working through the projects as I did while putting them together!

What this book covers

Chapter 1, Hello, World!, teaches you to set up our development environment and a web server and write our first Flask application.

Chapter 2, Getting Started with Our Headlines Project, shows you how to run Python code when the user visits a URL and how to return basic data to the user. We will also look at fetching the latest headlines automatically using RSS feeds.

Chapter 3, Using Templates in Our Headlines Project, introduces Jinja templates and integrates them into our Headlines project. We will show how to serve dynamic HTML content by passing data from our Python code to template files.

Chapter 4, User Input for Our Headlines Project, shows how to get input from our users over the Internet and use this input to customize what we will show our users. We will look at how to access currenct weather information through JSON APIs and include this information in our Headlines project.

Chapter 5, Improving the User Experience of Our Headlines Project, instructs you to add cookies to our Headlines project so that our application can remember our users' choices. We will also style our application by adding some basic CSS.

Chapter 6, Building an Interactive Crime Map, introduces our new project, which is a crime map. We will introduce relational databases, install MySQL on our server, and look at how to interact with our database from our Flask application.

Chapter 7, Adding Google Maps to our Crime Map Project, instructs you on adding a Google Maps widget and shows how to add and remove markers from the map based on our database. We will add an HTML form with various inputs for users to submit new crimes and also display the existing crimes.

Chapter 8, Validating User Input in Our Crime Map Project, polishes off our second project by making sure that users can't break it accidentally or through maliciously crafted input.

Chapter 9, Building a Waiter Caller App, introduces our final project, which is an application to call a waiter to the table at a restaurant. We will introduce Bootstrap and set up a basic User Account Control system that uses Bootstrap as the frontend.

Chapter 10, Template Inheritance and WTForms in Waiter Caller Project, introduces Jinja's template inheritance features so that we can add similar pages without duplicating code. We will use the WTForms library to make our web forms easier to build and validate.

Chapter 11, Using MongoDB with Our Waiter Caller Project, discusses how to install and configure MongoDB on our server and links it to our Waiter Caller project. We will finish off our final project by adding indices to our database and a favicon to our application.

Appendix, A Sneak Peek into the Future, outlines some important topics and technologies that we weren't able to cover in detail and gives pointers on where