Question

I have a user input form here:

http://www.7bks.com/create (Google login required)

When you first create a list you are asked to create a public username. Unfortuantely currently there is no constraint to make this unique. I’m working on the code to enforce unique usernames at the moment and would like to know the best way to do it.

Tech details: appengine, python, webapp framework

What I’m planning is something like this:

• first the /create form posts the data to /inputlist/ (this is the same as currently happens)
• /inputlist/ queries the datastore for the given username. If it already exists then redirect back to /create
• display the /create page with all the info previously but with an additional error message of “this username is already taken”

My question is:

1. Is this the best way of handling server side validation?
2. What’s the best way of storing the list details while I verify and modify the username?

As I see it I have 3 options to store the list details but I’m not sure which is “best”:

1. Store the list details in the session cookie (I am using GAEsessions for cookies)
2. Define a separate POST class for /create and post the list data back from /inputlist/ to the /create page (currently /create only has a GET class)
3. Store the list in the datastore, even though the username is non-unique.

Thank you very much for your help 🙂

I’m pretty new to python and coding in general so if I’ve missed something obvious my apologies.

Tom

PS – I’m sure I can eventually figure it out but I can’t find any documentation on POSTing data using the webapp appengine framework which I’d need in order to do solution 2 above :s maybe you could point me in the right direction for that too? Thanks!

PPS – It’s a little out of date now but you can see roughly how the /create and /inputlist/ code works at the moment here: 7bks.com Gist

Answer 1

I would use Ajax to do an initial validation. For example as soon as the user name input box loses focus I would in the background send a question to the server asking if the user name is free, and clearly signal the result of that to the user.

Having form validation done through ajax is a real user experience delight for the user if done correctly.

Of course before any of the data was saved I would definitely redo the validation server side to avoid request spoofing.

jQuery has a nice form validation plugin if you are interested. http://docs.jquery.com/Plugins/validation.

In my career, I’ve never gotten around having to validate server side as well as client side though.

About the storing of the list (before you persist it to the datastore). If you use ajax to validate the user name you could keep the other fields disabled until a valid user name is filled in. Don’t allow the form to be posted with an invalid user name!

That would perhaps solve your problem for most cases. There is the remote possibility that someone else steals the user name while your first user is still filling in his list of books. If you want to solve that problem I suggest simply displaying the list as you got it from the request from the user. He just sent it to you, you don’t have to save it anywhere else.