Django Module 5
Forms, validation and file uploads interview questions
Interview questions on forms, validation and file uploads: warm-ups, then what each harder question tests and how a good answer starts.
Warm-up questions
Short questions with short answers, each answered in full.
-
Fresher
What is the difference between a bound and an unbound form?
Answered in the lesson Forms: fields, widgets and the request cycle
-
Fresher to mid
When do you write a validator, and when a clean_<field>() method?
Answered in the lesson Validation: validators, clean() and model rules
-
Fresher
What does save(commit=False) return, and when do you need save_m2m()?
Answered in the lesson ModelForms, formsets and inline formsets
-
Fresher
A view finds request.FILES empty although the user chose a file. Why?
Answered in the lesson File uploads and storage, done safely
Questions with model answers
What each question tests, the first step of a good answer and the follow-ups to expect.
-
Fresher to mid
Residents say that when one field of the complaint form is wrong, the page comes back empty and the only sign of the problem is a red border. Screen-reader users cannot tell which field failed at all. What is wrong in the view and in the template, and how do you fix both?
- What it tests
- Rendering the bound form again after a failed is_valid(), how Django ties errors and help text to their inputs, and error messages that meet WCAG 2.2 for every user.
- First step
- Follow the failed POST through the view. If the branch where is_valid() returns False builds a new form, the values and the errors are gone before the template runs. Then read the template: is each error drawn in text next to its field, and does the input point at it?
- Follow-ups
-
- Which status code should the page come back with?
- The design puts the error under the input. How do you keep it accessible?
- How do you test that the fix holds?
From the lesson Forms: fields, widgets and the request cycle
Model answer, Pro. Model answers open with any pass; prices are in the notice on this page.Opening the model answers with your pass…
Model answers open with any MySmartCoPilot pass.
- Pro pass · 1 week₹79$2.99
- 30 days₹179$5.99
- 1 year₹1,699$45
One payment; a pass never renews. The price shown is the total you pay: no fees or charges are added at checkout.
Passes can’t be bought right now, so the model answers can’t be opened at the moment. If you have a pass, enter your licence key.
It also opens every other in-depth part in Learn and every Pro tool. Sales are final, except where the law gives you a right to withdraw, for example in the EU and the UK (refund policy).
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 4 minutes
-
Mid to senior
After a cache was put in front of Nivas, some residents get "403 Forbidden: CSRF verification failed" when they send the complaint form, while others send it without trouble. Nothing in the form changed. Why does this happen, and how do you fix it without switching CSRF protection off?
- What it tests
- How the CSRF token and the csrftoken cookie belong together, why a page served from a shared cache breaks that pairing, and which caching rules keep forms both working and protected.
- First step
- Compare what a failing resident holds: their csrftoken cookie and the token in the page they received. The middleware compares the secret of the token with the secret of that browser's own cookie, so ask where the page came from. If the cache served a copy drawn for another visitor, its token belongs to someone else.
- Follow-ups
-
- Why does it fail only for some residents?
- Which responses may a shared cache keep, and which must it never keep?
- Is csrf_exempt on this view an acceptable fix?
From the lesson Forms: fields, widgets and the request cycle
Model answer, Pro.In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 4 minutes
-
Mid to senior
Clubhouse bookings must end after they start, last at most 4 hours, never overlap another booking, and allow more than 10 guests only for committee members. Bookings arrive from the web form, the admin and a mobile API. Where do you enforce each rule, and why there?
- What it tests
- Choosing between form, model and database for each kind of rule: what each layer sees, which writes skip which checks, and how races and permissions change the answer.
- First step
- Sort the four rules by what each one needs to see: one row, other rows, or the user who is asking. Then list every path that writes a booking, and mark which of them would run a check placed in the form, in the model and in the database.
- Follow-ups
-
- How do you stop two overlapping bookings that arrive in the same second?
- Where does the mobile API check the guest rule?
- Which tests prove that every layer holds?
From the lesson Validation: validators, clean() and model rules
Model answer, Pro.In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 4 minutes
-
Mid to senior
A script imported 2,000 clubhouse bookings from a spreadsheet with bulk_create(). A week later the calendar shows 9-hour bookings and bookings with 40 guests, although the model has MaxValueValidator(10) on guests and a clean() that refuses more than 4 hours. Why did the rules not stop these rows, and what do you change?
- What it tests
- Which writes run model validation, running full_clean() in code that writes without forms, repairing bad rows, and moving rules that must always hold into the database.
- First step
- Ask which Django call runs each rule. Field validators and Model.clean() run inside full_clean(), and only ModelForms, the admin and code that calls it run them. bulk_create() inserts the objects as they are, so the import ran no Python rule at all; only the database's own constraints applied.
- Follow-ups
-
- How do you find and repair the bad rows already in the table?
- How should the import report the rows it refuses?
- Which of these rules should also be database constraints?
From the lesson Validation: validators, clean() and model rules
Model answer, Pro.In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
-
Fresher to senior
A resident of Nivas became a committee member through the profile page, although the page shows only name and phone. The profile form is a ModelForm with exclude = ['flat', 'user'], and is_committee was added to the model last month. Explain how it happened, fix it, and make sure it cannot come back.
- What it tests
- Recognising mass assignment in a ModelForm, why exclude and '__all__' fail open, listing fields, and a test that fails on the weak form and passes on the fix.
- First step
- List the fields the form really has, not the ones the page draws: with exclude, every editable model field but flat and user, so is_committee joined the form when it joined the model. Then confirm with one request that adds is_committee=on to the two fields of the page.
- Follow-ups
-
- Why did nothing fail when the field was added?
- How do you find every other form with the same weakness?
- What do you do about the committee members created this way?
From the lesson ModelForms, formsets and inline formsets
Model answer, Pro.In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
-
Mid to senior
The committee wants one page to edit all 300 parking slots of Nivas: who holds each slot and its vehicle number. Slots are never created or deleted on this page, and two committee members sometimes edit at the same time. How do you build it with formsets, and what can go wrong?
- What it tests
- Model formsets with edit_only, the management form and absolute_max, rules across rows such as one slot per vehicle, concurrent edits, and the cost of 300 forms on one page.
- First step
- Start from what the page may do: edit two fields of existing rows, nothing else. That fixes the formset's options before any template: a model formset of ParkingSlot with fields for the holder and the vehicle, edit_only=True, and limits sized for 300 rows.
- Follow-ups
-
- Two committee members save the page a minute apart. Whose changes survive?
- How do you stop one vehicle being given two slots?
- The page takes 4 seconds to load. Where does the time go?
From the lesson ModelForms, formsets and inline formsets
Model answer, Pro.In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 4 minutes
-
Mid to senior
Nivas has 1,200 flats, and residents attach phone photos of 3 to 8 MB to complaints, up to 4 a complaint. Only the resident and the committee may see them. Design the upload path: the limits, the checks, where the files live, how they are served, and what you do about the location data in the photos.
- What it tests
- Upload limits at each layer, content checks and image rewriting, storage names and places, private serving, the privacy of photo metadata, and estimates of storage and memory.
- First step
- Write the numbers down first: photos a day, their size, how long they are kept. Then follow one photo from the browser to the disk and name the limit or check at each step: the web server, Django's parser, the form, the storage, and the view that shows it.
- Follow-ups
-
- How much storage does a year of photos need?
- How are the photos shown to the committee and the resident only?
- A resident uploads a 40-megapixel photo. What protects the server?
From the lesson File uploads and storage, done safely
Model answer, Pro.In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 4 minutes
-
Mid to senior
A resident reports that a complaint attachment, opened from the notice board, showed a page asking for their Nivas password. The file was uploaded as a photo and is served from the site's own domain under /media/. How could that happen, and what do you change so that no upload can act as a page of the site again?
- What it tests
- How a browser decides to render a file, why uploads served from the site's own origin are dangerous, and the fixes: content checks, rewriting, nosniff, attachment and a separate domain, with a check that proves them.
- First step
- Check what the stored file really is and how it was served: its first bytes, the Content-Type and other headers of the response, and the domain. A file the browser shows as a page on the site's own domain is trusted like any other page of the site.
- Follow-ups
-
- The upload passed ImageField's check. How?
- Which headers would have kept the browser from showing it as a page?
- How do you check the files already stored?
From the lesson File uploads and storage, done safely
Model answer, Pro.In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 4 minutes