POSTing ajax data in query-string format to Django

1. Sending query-string formatted data with jQuery.ajax()

The 'data' setting of jQuery.ajax() setting may either contain a String or a PlainObject.

In case of a string, the data is sent 'as-is'. See example 1:
$.ajax({
   type: 'POST',
   data: "test,1,2,3");
-> data will be sent as "test,1,2,3"

In case of an object, it is automatically converted to a query-string, no matter what the 'contentType' setting is. See example 2:
$.ajax({
   type: 'POST',
   data: {"test": 1, "test2"="two"});
-> data will be sent as "?test=1&test2=two"

Objects must be a set of key/value pair(s). If any value is an array, the conversion depends on the traditional setting.

If 'traditional' is set to true, the ajax() method will only be able to send shallow objects: a value can be an indexed array, but not an associative array (use json instead). The conversion looks like this (=  example 3):
$.ajax({
   type: 'POST',
   traditional: true,
   data: {"a": [1,2,3], "b": "four"});
-> data will be sent as "?a=1&a=2&a=3&b=four"

If 'traditional' is set to false (= default setting as of jQuery 1.8), complex objects can also be serialized. In this case, the keys that contain an array value are converted to an array-like notation. For example, the object from the previous example will look like this (= example 4, see the jQuery docs for more):
$.ajax({
   type: 'POST',
   traditional: false,
   data: {"a": [1,2,3], "b": "four"});
-> data will be sent as "?a%5B%5D=1&a%5B%5D=2&a%5B%5D=3&b=four"
-> this equals: ?a[]=1&a[]=2&a[]=3&b=four

2. Django automatically parses query-string data

Django will try to parse the input data and use it to populate the HttpRequest.GET or HttpRequest.POST object. These are dictionary-like objects containing all given parameters passed through the GET url or POST body.

Note that the contentType parameter must be set to application/x-www-form-urlencoded' (= the default). If you explicitly set another contentType, django will not populate the HttpRequest.GET or HttpRequest.POST objects.

If the data is a string, django will create a QueryDict with a single key (= the string) and a list containing an empty string as value. Example 1:
-> HttpRequest.POST = <QueryDict: {u'test,1,2,3': [u'']}>

In case of a simple object (no array values), keys and values will correspond to the ones that were sent. Integer values are converted to unicode strings. Example 2:
-> HttpRequest.POST = <QueryDict: {u'test': u'1', u'test2': u'two'}>

In case the object has at least one array value, converted with traditional set to true, all QueryDict values are converted to arrays (of which the content corresponds to the javascript object, with integer values being converted to unicode strings).
Example 3:
$.ajax({
   type: 'POST',
   traditional: true,
   data: {"a": [1,2,3], "b": "four"});
-> data will be sent as "?a=1&a=2&a=3&b=four"
-> django will store the input data in HttpRequest.POST as:
<QueryDict: {u'a': [u'1', u'2', u'3'], u'b': [u'four']}>

 In case the object has at least one array value, converted with traditional set to false, django's QueryDict keys will also have the array-like notation. Example 4:
<QueryDict: {u'a[]': [u'1', u'2', u'3'], u'b': [u'four']}>

The QueryDict object has a getlist() method, which must be used to retrieve an array value as a python list.

3. Don't forget to send the csrf_token

If you're POSTing a query-string formatted object with jQuery.ajax(), you could include a 'csrfmiddlewaretoken'  key as part of the object (containing the actual token string as its value). Django will automatically find and process it, so you don't have to set the custom X-CSRFToken header.

$.ajax({
   type: 'POST',
   data: {"test": 1, "csrfmiddlewaretoken":"kigLe2yn9pgaDZjkl9fsk7vZoAW7OkrU"});
-> HttpRequest.POST = test': u'1', u'csrfmiddlewaretoken': 'kigLe2yn9pgaDZjkl9fsk7vZoAW7OkrU'}>

Comments

Post a Comment

Popular posts from this blog

Handling control characters (escaping) in python for json and mysql

JSON loads() and dumps(): how control characters are handled The json lib escapes control characters when you dump(s) a python object into a json string. import json aa = "String with\ttab and\nnewline" print "1. Py string with control chars, unescaped: '%s'" % aa aa = json.dumps(aa, indent = 2, encoding="utf8") # dumping py-obj into json-string will cause control chars to be escaped print "\n2. JSON Encoded String with control chars, escaped: '%s'" % aa aa = json.loads(aa) # loading json-string into py-obj will leave control chars unescaped print "\n3. Py object (= string) with control chars, unescaped: '%s'" % aa Output: 1. Py string with control chars, unescaped: 'String with tab and newline' 2. JSON Encoded String with control chars, escaped: '"String with\ttab and\nnewline"' 3. Py object (= string) with control chars, unescaped: 'String with tab and newline' Note that json.l...
Read more

python port sniffer with pcapy and impacket

The code below will sniff all network traffic (use a filter to limit the sniffer to only certain packets) during 1000 milliseconds and print some info about it. It requires 2 python modules: pcapy for capturing the packets impacket for analyzing the packet content Note that this sample uses pcapy's dispatch() method and relies on its ability to return automatically after a timeout expires. This functionality is not available on all platforms (e.g. not on linux). import os, logging, socket import pcapy, impacket, impacket.ImpactDecoder ETHERNET_MAX_FRAME_SIZE = 1518 PROMISC_MODE = 0 class Packet(object): def __init__(self, bytes, sniffed_bytes, timestamp, proto_id, src_ip, tgt_ip, src_port, tgt_port, msgs): """ @brief Initialize data. """ super(Packet, self).__init__() self.bytes = bytes self.sniffed_bytes = sniffed_bytes self.src_ip = src_ip self.tgt_ip = tgt_ip self.src_port = src_port self.tgt_port = tgt_port ...
Read more

Django field, form and model validation process

Django's form and field validation process can be best understood by looking at the code in django's BaseForm class (in django.forms.forms) - see below. See also this blog post for a graphic overview. The form.full_clean() method is called by django at the start of the validation process (by form.is_valid(), usually immediately after the view receives the posted data). full_clean() performs a 3 phase validation , with each phase corresponding to a call of one of the protected methods below: self._clean_fields() : Field validation This method iterates over the form fields: For each field, it calls the Widget's value_from_datadict() method, passing the complete post data in a QueryDict. The Widget's task is to retrieve its own value from this QueryDict and return it. The returned value is then passed to the Field's own clean() method. This method does the initial validation (e.g. checking if the value is not empty), without touching the db. If the Field's...
Read more