web2py - Adding a nonce to a form that was manually created -

is there way add nonce manually created form? example, creating sqlform in controller , rendering {{=form}} in views automatically attach nonce form.

but manually created this:

<form>     <input type="text">     <button type="submit">submit</button> </form> 

won't have nonce.

you can construct , process form object in controller usual using form() or sqlform(). in case, can still create custom html form in view (as long input field names match) -- have include special hidden _formname , _formkey fields, can via form.custom.end.

in controller:

def myform():     return dict(form=sqlform(db.mytable).process()) 

in view:

<form>     <input type="text">     <button type="submit">submit</button> {{=form.custom.end}} 

note, form.custom.end includes closing </form> tag, no need add explicitly.

if want html more explicit, can access _formname , _formkey values via form.formname , form.formkey, do:

<form>     <input type="text">     <button type="submit">submit</button>     <div style="display:none;">         <input name="_formkey" type="hidden" value="{{=form.formkey}}" />\         <input name="_formname" type="hidden" value="{{=form.formname}}" />     </div> </form> 

this produces same html version above using form.custom.end.

note, web2py stores _formkey value in session using _formname key retrieve session. when form submitted, .process() method retrieves _formkey value session , checks matches _formkey value submitted form -- if not, processing fails.

finally, if want create own custom formkey , handle storing in session , comparing value submitted form yourself, can do:

from gluon.utils import web2py_uuid() custom_formkey = web2py_uuid() 

you have handle formkey check explicitly.