10

I'm guessing this is going to involve regexp or something, but I'll give it a shot. At the minute, a user can break a website by typing something similar to £$(*£$(£@$&£($ in the title field, which is converted into a slug using Django slugify.

Because none of these characters can be converted, Django returns an error. My question is, what should I put in the form validation method to raise a forms.ValidationError when the user uses a title like this?

Thanks.

user116170
  • 351
  • 1
  • 3
  • 11

2 Answers2

19

This question is half a decade old so in updating my question I should explain that I'm at least nodding to the past where some features might not have existed.

The easiest way to handle slugs in forms these days is to just use django.models.SlugField. It will validate itself for you and imply that this field is an index.

If you're not using this on a model, you can still hook in the same validator that SlugField uses:

from django.core.validators import validate_slug

slug = forms.CharField(..., validators=[validate_slug])

If you just want to do behind-the-scenes checking or write your own validator, you can use a similar technique to pull in Django's definition of a valid slug. It's just the compiled regex that validate_slug above uses:

from django.core.validators import slug_re

if slug_re.match(...):
    ...

I can't imagine it will change, but by locking yourself to Django's idea of a slug, you'll ensure consistency if Django does change one day.

Oli
  • 235,628
  • 64
  • 220
  • 299
  • 2
    Seems to work. Thanks a lot mate. In clean_field method: if re.match("[a-zA-Z0-9]+", potential_slug) == None: raise forms.ValidationError("The title is not sluggable.") – user116170 Jun 02 '09 at 19:08
  • This regex doesn't account for the VERY COMMON use of hyphens "-" in slugs. Also, \d is redundant because \w covers digits too. Ben's answer below is more correct. – Humphrey Aug 15 '11 at 05:56
  • Ben's answer below is more correct. [a-zA-Z0-9]+ matches neither the underscore nor the hyphen, [\w\d]+ matches underscores but not the hyphen. – Klaas van Schelven Aug 27 '12 at 09:42
  • 2
    Well it only took me a few years to improve the answer. I think it should cover most people's reservations now. – Oli Apr 10 '14 at 14:28
12
SLUG_REGEX = re.compile('^[-\w]+$')
Daniil Ryzhkov
  • 7,416
  • 2
  • 41
  • 58
Ben
  • 121
  • 1
  • 2