Django实战：安全高效地处理HTML表单提交与用户数据存储

<form id="signup-form" action="/signup/" method="post">
    {% csrf_token %} {# 重要的CSRF令牌，用于安全防护 #}

    <label for="name">全名</label>
    <input autocomplete="off" type="text" name="username" id="name" class="name">

    <label for="email">电子邮件地址</label>
    <input autocomplete="off" type="email" name="emailAddress" id="email" class="email">

    <label for="phone">电话号码 - <small>可选</small></label>
    <input autocomplete="off" type="text" name="phone" id="phone">

    <label for="password">密码</label>
    <input autocomplete="off" type="password" name="password" id="password" class="pass">

    <label for="passwordCon">确认密码</label>
    <input type="password" name="passwordCon" id="passwordCon" class="passConfirm">

    <input type="submit" form="signup-form" value="立即注册" id="submit">
</form>

# myapp/urls.py
from django.urls import path
from . import views

urlpatterns = [
    path("signup/", views.signUpView, name="user-signup"),
]

# myapp/views.py
from django.contrib.auth.models import User
from django.contrib.auth import login
from django.shortcuts import render, redirect

def signUpView(request, *args, **kwargs):
    # 1. 判断请求方法：是POST请求（表单提交）还是GET请求（显示表单）
    if request.method == "POST":
        # 2. 从request.POST中提取表单数据
        # 使用.get()方法获取数据，如果字段不存在则返回None，避免KeyError
        username = request.POST.get("username")
        email_address = request.POST.get("emailAddress") # 注意HTML中的name是emailAddress
        password = request.POST.get("password")
        phone_number = request.POST.get("phone") # 可选字段
        password_confirm = request.POST.get("passwordCon") # 确认密码字段

        # 3. 简单的后端数据验证（实际项目中应更全面）
        if not all([username, email_address, password, password_confirm]):
            # 可以在这里添加错误信息并重新渲染表单
            return render(request, "signupPage.html", {"error": "所有必填字段都不能为空。"})

        if password != password_confirm:
            return render(request, "signupPage.html", {"error": "密码和确认密码不匹配。"})

        # 4. 将数据存储到数据库 (使用Django内置User模型)
        try:
            # 使用User.objects.create_user()是创建用户并自动哈希密码的最佳实践
            user = User.objects.create_user(
                username=username,
                email=email_address,
                password=password # create_user会自动哈希密码
            )
            # 如果有其他可选字段，可以在用户创建后设置
            # user.profile.phone_number = phone_number # 假设User模型有相关联的Profile
            user.save()

            # 5. 用户登录
            login(request, user)

            # 6. 重定向到成功页面（例如首页）
            return redirect("homepage") # 假设您有一个名为'homepage'的URL
        except Exception as e:
            # 处理用户已存在或其他数据库错误
            return render(request, "signupPage.html", {"error": f"注册失败：{e}"})
    else:
        # 7. 如果是GET请求，渲染注册表单页面
        return render(request, "signupPage.html")