Building data-driven web apps with Flask and SQLAlchemy Transcripts
Chapter: User input and HTML forms
Lecture: Creating the user
Login or
purchase this course
to watch this video and the rest of the course contents.
0:00
Well we've almost finished the registration process
0:02
and our interaction with forms are working really well.
0:04
But, let's go work on this other bit here.
0:07
Let's actually go and create the user.
0:09
So let's do this.
0:10
Let's say the user's going to be our user_service
0:13
remember we're doing lots of stuff with the database
0:15
and users, so we created our user_service over here.
0:19
So we can just import that.
0:22
We're going to add a function, not get_user_count
0:24
but create_user.
0:26
We're going to have a bunch more things as well
0:27
and we can just pass the values: name, email and password.
0:33
Now, this doesn't exist yet
0:34
but, you know what, we can have PyCharm write it for us
0:37
and this can be a string and a string and a string.
0:44
And let's actually tell it here
0:46
that it's going to return not a user
0:48
but an optional user. Why optional?
0:52
Well you'll see in a second.
0:53
But we definitely want to return
0:54
some kind of user here.
0:56
That's just the end of the line, okay.
0:59
Cool, cool, okay.
1:00
So what we need to do here is
1:01
we should also do some validation
1:03
on name and email and so on
1:04
but we're doing that at the top as well.
1:06
Let's just trust it for the moment
1:08
but in a real site we would add that.
1:09
So how do we do this?
1:10
We're going to create a user, like so.
1:15
And we're going to set some values.
1:17
Now, be super, super careful here.
1:20
Do you do this? Maybe? No.
1:24
Bad, bad, don't do that.
1:25
You never, ever, ever want to store
1:28
your password directly in the database.
1:31
It's such a bad idea to store the password in plain text.
1:34
If for some reason you have a SQL injection attack
1:37
or your database gets lost, or whatever
1:40
all sorts of bad things are going to happen.
1:42
So we never, ever, ever want to do this.
1:43
So instead, let me show you how we're going to
1:45
handle passwords in our app.
1:47
So come over here, and let's check out
1:49
this thing called passlib.
1:50
This is one of my favorite of all time modules for Python
1:53
because it just takes this tricky problem
1:56
and makes it super, super nice.
1:58
So the way that it works is this thing will go
2:01
you can import it and it will go and hash up
2:04
some kind of thing like, I don't know, a password.
2:07
And then it will verify it.
2:09
Now, of course you could use MD5 or SHA512 or whatever
2:14
but this does a lot more.
2:15
It also creates random salt, that is like
2:17
words that are mixed in with the password.
2:20
And it folds it many, many times.
2:23
Now what I mean by that, instead of just
2:24
taking the value and hashing it
2:25
it takes that result and hashes it again
2:27
and then it hashes it again and hashes it again
2:29
like 150,000 times.
2:32
So this is a much, much harder to break password
2:35
if for some reason someone were able to access your database
2:38
and get a hold of the emails and the passwords.
2:42
So this is pretty easy for us to use.
2:44
We have to add passlib to our requirements
2:51
down here like so.
2:54
Make sure those get installed.
2:56
So this is all good
2:57
and then up here at the top
2:59
we need to go and import some stuff.
3:00
But we're going to go over here
3:01
and we're going to say
3:07
from passlib.handlers.sha2_crypt import sha512_crypt as crypto
3:08
We're going to import SHA512
3:12
and let's do this as crypto.
3:16
That way when we use it below
3:17
if for some reason we decide we want
3:18
to change our handler or something
3:20
we can do that pretty easily.
3:22
So now I'm just going to drop two functions down here.
3:24
One is to do the hashing and one is to do the verification.
3:27
Okay?
3:28
So we have hash.txt, which takes plain text and encrypts it
3:32
and we're setting the rounds
3:33
to be something kind of random but really high.
3:35
171,204 iterations, that's going to make it
3:39
extremely computationally challenging to break.
3:43
And then we want to go and verify it.
3:45
You can't directly compare these
3:47
because each encryption result results in using random salt
3:51
but once one of these strings exists
3:53
it knows how to verify it.
3:54
So what we're going to do here
3:55
is just a super simple hash.txt
3:57
and give it the password.
3:59
There we go. That's much better.
4:01
And now we're going to need one of these sessions, like so.
4:04
I'm going to say session.commit when we're done
4:07
and we're going to return the user.
4:09
All right, and then before we actually call commit
4:12
we need to do session.add, remember that?
4:14
And that'll add it here.
4:15
Now, this all looks pretty good.
4:17
There's one other issue, we may have a problem here.
4:20
So let's just write one more function
4:21
and you'll see why.
4:23
Def find_user_by_email.
4:32
And it's going to do something super simple
4:33
but it's going to come down here and say
4:36
return session of query.
4:38
And so what we're going to do is find
4:40
and see if somebody's already registered
4:42
with this email address
4:43
because that would be bad to re-register them, right?
4:53
All right, so that's going to just give us the one user back
4:56
and let's say if find_user_by_email
5:01
this email address, return None.
5:05
So we don't want to create the user
5:07
otherwise this user has not registered with us yet
5:09
we're going to create their account
5:11
we're going to set their values, hash their password
5:14
put them in the database, commit it and return it.
5:17
Phew, all right.
5:18
So that seems like a lot, but I think we're good.
5:20
Let's do a quick test, if not user
5:21
that meant we couldn't create it.
5:23
Let's do something like this. Here we go.
5:28
So if for some reason the thing already exists
5:31
we're going to bail, otherwise we'll redirect.
5:33
Let's go and actually do a quick query, look in our database
5:35
and see if this user already exists, or not.
5:39
It shouldn't exist. Go here.
5:44
Say select star from users.
5:47
What your email is, michael@talkpython.fm.
5:53
We run that, look, zero rows.
5:54
All right, now, now let's go try to run this, here.
5:59
Make sure everything's working, good, good.
6:01
Now let's go try to register again.
6:03
So I'm going to be Michael.
6:09
Right, here we go.
6:10
It should go through, actually let's not
6:12
put the password yet. Some fields are missing.
6:15
Let's go and try to register.
6:17
Boom, it went through. It didn't crash.
6:20
All of these are really good signs.
6:22
Let's go to the database and ask that question again.
6:25
Look at that, user 85 is now registered.
6:28
Michael, michael@talkpython.
6:29
Here's that crazy password.
6:32
Like, that's really not very much
6:34
at all like what I typed, right?
6:36
That's not the letter a.
6:37
Down here we have our logins, our created_date
6:40
we didn't set the profile image, that's all fine.
6:42
Let's do one more test.
6:43
Let's go back and try to register again.
6:45
I'm Jeff. And my email address is that.
6:50
Let's try again. A user with that email already exists.
6:53
Okay, great, I think our forms
6:55
and our user interaction is pretty good.
6:57
At least on the registration level.
