Question

I am quite new to django, and I have built a small page using forms.
When I go to the template and use the template tags, such as:

{{form.q}}

everthing is fine, and I see the form input field. However, I do not really like the input “box” it provides and I want to override this feature.

So, in my HTML, I would have something like:

<input id="customfield" name="q" type="text"/>

I tried the above, and everything seems to work fine. However, if I use for example:

<input id="customfield" name="{{form.q}}" type="text"/>

it dosent work. So, my question is:

[1] Is it ok to use name=”q” or how can one specify {{form.q}} if I have a custom input?
[2] Are there any disadvantages (like sql injection) when using name=”q” as opposed to simply using {{form.q}}?

Sorry for the 101 questions!

Answer 1

This is exactly how you would build a form if you wanted this much control in the template.

You’d take this course when other django shortcuts have failed, like one of the build in widgets that determine the way your field is rendered.

Update: after reading your comment, if you just want to inject attributes to the input element, you can pass the widget a dictionary containing attribute:value pairs.

q = forms.CharField(widget=forms.TextInput(attrs={'class': 'foobar'}))

SQL injection is irrelevant here (you’d worry about this when a user has something to do with SQL written on your server) and there are no disadvantages, aside from the code being more difficult to write and maintain.