Currently, I'm trying to retrieve upvote/downvote data from a Django template in the following manner:
<form method="POST" action="{% url 'vote' %}" class="vote_form">
{% csrf_token %}
<input type="hidden" id="id_value" name="value" class="hidden_id" value="{{ btn1.value }}" />
<button type="input" name="btn1" value="1">upvote</button>
<button type="input" name="btn1" value="-1">downvote</button>
</form>
Note: The object being voted on and the user_id creating the vote are also passed, using similar "hidden" input tags I've omitted copying above
I'm encountering an issue with my input tag. value="{{ btn1.value }}" is intended to point to the specific button clicked and transfer its value to the view for vote processing.
However, my current syntax or logic seems to be flawed. Can you provide any feedback on what might be going wrong?
Additionally, I feel uneasy setting integer values for upvotes/downvotes in the template. I believe there must be a more secure approach to handle this. Any suggestions or best practices in this area would be greatly appreciated!
p.s. for better context, here's what is happening in my view:
class VoteFormView(FormView):
form_class = VoteForm
def form_valid(self, form):
link = get_object_or_404(Link, pk=form.data["link"])
user = self.request.user
val= form.data["value"]
prev_votes = Vote.objects.filter(voter=user, link=link)
has_voted = (prev_votes.count() > 0)
if not has_voted:
Vote.objects.create(voter=user, link=link, value=val)
else:
prev_votes[0].delete()
return redirect("home")