What is a more efficient way to pass variables from Template to View in Django?

django, python, templates, view

Solution

There are broadly 3 ways to hold onto this kind of information:

Session (my suggestion for your situation)

Just stuff the data you want into the `request.session` dictionary; it'll persist per-user, and you can access it easily:

# view1
request.session['name1'] = male_results
request.session['userid1'] = male_pic_userid

# view2 (or elsewhere in view1)
male_results = request.session.get('name1')
male_pic_userid = request.session.get('userid1')

Advantages

- No changes needed to your templates (except removing your now-unnecessary forms).

- Clean URLs

- Persists even through closing and re-opening the browser window

- You don't need to worry about users modifying or even seeing the session data (it's way more secure)

Disadvantages

- As with `POST`, page content is dictated by the URL and session data — URLs are no longer unique, and users can't share a particular page that relies on session info

Query parameters

Something like `/match/?name1=foo1&userid1&name2=bar&userid2=2`. You can either add these manually (`<a href='/match/?name1={{ male_results }}...`) or by changing your `POST` form to `GET`.

Advantages

- These URLs can be shared and bookmarked; if it's a list with filtering options, this is probably desirable ("Here's the list of cars I like" posted to Facebook, etc.)

Disadvantages

- As you've already noted, these can be freely modified by the user

- Adding these to every URL is a massive pain

POST form (your current approach)

Advantages

- A little more hidden (nothing user-visible without some kind of browser extension)

- Slightly harder to manipulate (though don't rely on this security-through-obscurity)

- Cleaner URLs

Disdvantages

- Leads to "this page has expired" messages on Internet Explorer if you use your browser's "back" button ...

- ... and "Are you sure you want to re-send this data" messages on most browsers if users try to reload any of your pages

- All this state information will be lost if a user re-opens the page (pressing "return" in the URL bar, for instance)

- Users can't share the exact page they're looking at; the content is partly determined by non-user-visible information

- Adding `POST` data to every navigation action is a huge pain.

Problem

My question involves passing variables from the template to view in Django. I know of passing variables in the URL and through a form. The problem I have with the first one is that the url could be manipulated which is not what I want. Is there anyway to prevent that? Right now this is what I have as a band-aid: ``` <form action="/match/" method="post"> {% csrf_token %} <input type="hidden" name="name1" value="{{ male_results }}"> <input type="hidden" name="userid1" value="{{ male_pic_userid }}"> <input type="hidden" name="name2" value="{{ female_results }}"> <input type="hidden" name="userid2" value="{{ female_pic_userid }}"> <input type="submit" value="Submit" /> </form> ``` Is there a way to avoid having to use this? Thank you!

Original source