django 跨站請求偽造
阿新 • • 發佈：2019-01-02
def login(request): if request.method == 'POST': user = request.POST.get('username',None) pwd = request.POST.get('password',None) if user == 'alex' and pwd =='123': request.session['is_login'] = {'user':user} return redirect('/app02/index/') else: return render_to_response('/app02/login.html',{'msg':'使用者名稱或密碼錯誤'},context_instance=RequestContext(request)) return render_to_response('app02/login.html',context_instance=RequestContext(request)) ==================== login.html <!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <title></title> </head> <body> <form action="/app02/login/" method="POST"> {% csrf_token %} <p><input name = 'username'/></p> <p><input name = 'password'/></p> <p><input type = 'submit' value="提交"/><label style="color:red">{{ msg }}</label></p> </form> </body> </html>