Why am I getting Bad request error for my flask code?

Question

I have a code like this. This is giving me 400 Bad request error. I found that there is only one form in the page from which the form is submitted.

@auth.route('/admin/project/add',methods = ['POST', 'GET']) 
def addproject():
    if request.method == 'POST':
        projectname = request.form['projectname']
        c, conn = connection()
        query = "SELECT id from projects WHERE UPPER(project)='{}'".format(projectname)
        c.execute(query)
        value = c.fetchall
        if value>0:
            return render_template('addproject.html')  
        else:
            flash("Project already exists. Please goto projects page and confirm. If it is and error, please contact devloper.")
            return redirect(url_for('addproject'))  
    else:        
        return render_template('addproject.html')

I am also adding my HTML code for the form below. I tried a lot and is not able to figure out why I am keeping on getting that error. I also did small changes in my views.py,still the result is same.

 <form action="/admin/project/add" id="myForm" method="POST" name="add">
                                    <div class="form-body">
                                        <div class="row p-t-20">
                                            <div class="col-md-6">
                                                <div class="form-group">
                                                    <label class="control-label">Project Name</label>
                                                    <input type="text" id="projectname" class="form-control" placeholder="Please enter project name" required >
                                                    </div>
                                            </div>
                                            <!--/span-->
                                            <div class="col-md-6">
                                                <div class="form-group has-danger">
                                                    <label class="control-label">Project Location</label>
                                                    <input type="text" id="projectlocation" class="form-control form-control-danger" placeholder="Please enter project location" required >
                                                    </div>
                                            </div>
                                            <!--/span-->
                                        </div>
                                        <!--/row-->
                                        <div class="row">
                                            <!--/span-->
                                            <div class="col-md-6">
                                                <div class="form-group">
                                                    <label class="control-label">Starting Date</label>
                                                    <input type="date" class="form-control" placeholder="dd/mm/yyyy" required >
                                                </div>
                                            </div>
                                        <div class="col-md-6">
                                                <div class="form-group">
                                                    <label class="control-label">End Date</label>
                                                    <input type="date" class="form-control" placeholder="dd/mm/yyyy" required >
                                                </div>
                                            </div>

                                            </div>
                                            <div class="row">
                                                <div class="col-md-6">
                                            <div class="form-group has-danger">
                                                    <label class="control-label">Leader</label>
                                                    <input type="text" id="lead" class="form-control form-control-danger" placeholder="Please enter the leader for the project" required >
                                                    </div>
                                                </div>

                                                <div class="col-md-6">
                                            <div class="form-group has-danger">
                                                    <label class="control-label">Current Status</label>
                                                    <select class="form-control" required>
                                                        <option value="">--Select--</option>
                                                        <option value="T">T</option>
                                                        <option value="D">D</option>
                                                        <option value="S">S</option>
                                                    </select>
                                                    </div>
                                                </div>
                                            </div>

                                            <!--/span-->

                                            <!--/span-->
                                        </div>
                                        <!--/row-->
                                        <h5 class="box-title m-t-40">Project Description (optional)</h5>
                                        <hr>
                                        <div class="col-md-6">
                                            <div class="form-group has-danger">

                                                    <TEXTAREA rows="8" cols="138"></TEXTAREA>
                                                    </div>
                                                </div>
                                            <!--/span-->
                                        </div>
                                    </div><div class="col-md-6">
                                    <div class="form-actions">
                                        <button type="submit" class="btn btn-success" name="add"> <i class="fa fa-plus" value="Add"></i> Add</button>
                                        <button type="button" class="btn btn-inverse" onclick="viewproject();" name="cancel" value="Cancel">Cancel</button>

                                        {% with messages = get_flashed_messages() %}
         {% if messages %}
            <ul>
               {% for message in messages %}
               <li<{{ message }}</li>
               {% endfor %}
            </ul>
         {% endif %}
      {% endwith %}

                                    </div></div>
                                </form>

`.format()` on SQL is a no go. You will be vulnerable to SQL injections. Use the formatting function provided by your database adapter. — Klaus D., Jul 09 '18 at 04:43
@KlausD. I know tht, I will later change it using sqlalchemy — qwww, Jul 09 '18 at 04:44
There's no better time to fix a security related error than *now*. — Klaus D., Jul 09 '18 at 04:45
But I am not able to understand about sql alchemy..I am still learning it — qwww, Jul 09 '18 at 04:46

pafreire · Accepted Answer · 2018-07-09T05:07:57.253

1

The answer to your question is in the addproject.html file and the way that sends the parameter.

To solve it check for mistakes in the name of the parameter ('projectname'). See if the name is the same in the addproject.html file.

Another common problem is set incorrectly the 'content-type'.

After you edit your question with the form code, I saw you are using input id instead input name in the form.

The correct way is:

<input type="text" name="projectname" ... >

I hope this helps!

edited Jul 09 '18 at 05:07

answered Jul 09 '18 at 04:52

pafreire

146
3

Another common problem is set incorrectly the 'content-type'. what is this? – qwww Jul 09 '18 at 05:01
@qwww look this link for getting more information about 'content-type': https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Type – pafreire Jul 09 '18 at 05:23

Why am I getting Bad request error for my flask code?

1 Answers1