Python Flask Blog Project Syllabus

What does db.create_all() do and where is it typically run?

It creates all database tables defined by your model classes that don't yet exist. It is run once within an application context, e.g. inside 'with app.app_context():' or a setup script.

In Flask-SQLAlchemy, how do you define a primary key integer column for a model?

id = db.Column(db.Integer, primary_key=True). SQLAlchemy auto-increments integer primary keys by default.

Write the core fields of a User model for a blog (id, username, email, password).

class User(db.Model):\n id = db.Column(db.Integer, primary_key=True)\n username = db.Column(db.String(80), unique=True, nullable=False)\n email = db.Column(db.String(120), unique=True, nullable=False)\n password = db.Column(db.String(255), nullable=False)

Why should a user's password be stored as a hash rather than plaintext?

If the database is breached, plaintext passwords are immediately exposed. Hashing (e.g. via werkzeug's generate_password_hash) stores a one-way digest, so the original password cannot be trivially recovered.

Which Werkzeug functions hash and verify passwords in a Flask app?

generate_password_hash(password) creates the hash; check_password_hash(stored_hash, password) verifies a candidate password against it. Both come from werkzeug.security.

What does the 'unique=True' column option enforce in a SQLAlchemy model?

It adds a UNIQUE database constraint so no two rows can share the same value for that column (e.g. ensuring usernames or emails are not duplicated).

What does 'nullable=False' mean on a SQLAlchemy column?

It enforces a NOT NULL constraint, requiring that column to always have a value; inserting a row without it raises an error.

Write the core fields of a blog Post model linked to a User.

class Post(db.Model):\n id = db.Column(db.Integer, primary_key=True)\n title = db.Column(db.String(120), nullable=False)\n content = db.Column(db.Text, nullable=False)\n date_posted = db.Column(db.DateTime, default=datetime.utcnow)\n user_id = db.Column(db.Integer, db.ForeignKey('user.id'), nullable=False)

What is a foreign key, and how is one declared in Flask-SQLAlchemy?

A foreign key links a row to a row in another table. Declared with db.Column(db.Integer, db.ForeignKey('user.id')), referencing the target table.column.

How do you establish a one-to-many relationship from User to Post in SQLAlchemy?

On the User model add: posts = db.relationship('Post', backref='author', lazy=True). One user (author) can have many posts; backref adds 'author' to each Post.

What does the 'backref' argument in db.relationship() create?

It automatically adds a reverse attribute on the related model. For example backref='author' on User.posts lets you access post.author from a Post instance.

What is Flask-Login and what problem does it solve?

It is an extension that manages user session/authentication state — logging users in and out, remembering sessions, and protecting views — so you don't hand-code session handling.

Which command installs Flask-Login?

pip install Flask-Login

What are the steps to configure Flask-Login in an app?

1) from flask_login import LoginManager. 2) login_manager = LoginManager(app). 3) Set login_manager.login_view = 'login'. 4) Define a @login_manager.user_loader function. 5) Make the User model inherit UserMixin.

What does inheriting UserMixin add to a Flask-Login User model?

It provides default implementations of the required properties/methods: is_authenticated, is_active, is_anonymous, and get_id(), so the model works with Flask-Login without manual definitions.

What is the role of the user_loader callback in Flask-Login?

It is decorated with @login_manager.user_loader and, given a stored user id from the session, returns the corresponding User object (or None). Flask-Login calls it to reload the logged-in user on each request.

What does login_manager.login_view configure?

It names the view/endpoint users are redirected to when they try to access a @login_required page while not logged in (e.g. the 'login' route).

How do you log a user in and out using Flask-Login functions?

login_user(user) starts the authenticated session (optional remember=True). logout_user() ends it. Both are imported from flask_login.

What does the @login_required decorator do?

It protects a view so only authenticated users can access it; unauthenticated requests are redirected to the configured login_view.

What is Flask-WTF and why is it used for login/registration forms?

Flask-WTF integrates the WTForms library with Flask, providing form classes, field validation, and automatic CSRF protection, making secure form handling straightforward.

Write a basic Flask-WTF LoginForm class.

class LoginForm(FlaskForm):\n email = StringField('Email', validators=[DataRequired(), Email()])\n password = PasswordField('Password', validators=[DataRequired()])\n submit = SubmitField('Login')

What do the DataRequired and Email validators do in WTForms?

DataRequired ensures the field is not empty/whitespace; Email checks that the input is a syntactically valid email address. Validation failures populate field.errors.

How does a Flask view distinguish a form submission from an initial page load?

With if form.validate_on_submit(): which returns True only on a POST request where all validators pass; otherwise the template is rendered with the (possibly errored) form.

What is CSRF and how does Flask-WTF protect against it?

CSRF (Cross-Site Request Forgery) tricks a logged-in user into submitting unwanted requests. Flask-WTF embeds a signed CSRF token (via SECRET_KEY) in each form and validates it on submission, rejecting forged requests.

What is a Flask route, and how is one defined for the blog home page?

A route maps a URL to a view function via a decorator. Example: @app.route('/') \n def home(): return render_template('home.html').

How do you specify which HTTP methods a Flask route accepts?

Pass the methods list to the decorator, e.g. @app.route('/login', methods=['GET', 'POST']). By default a route only accepts GET (and HEAD/OPTIONS).

How do you create a dynamic route to view a single blog post by id?

@app.route('/post/<int:post_id>') and define the view as def post(post_id): ... . The <int:post_id> converter passes the id as an integer argument.

How do you fetch a record or return 404 if it doesn't exist in Flask-SQLAlchemy?

Use Model.query.get_or_404(id), e.g. Post.query.get_or_404(post_id). It returns the row or aborts with a 404 Not Found.

How do you insert a new record (e.g. a Post) into the database in SQLAlchemy?

Create the object, then db.session.add(post) followed by db.session.commit(). add stages it; commit writes it to the database.

What is the role of url_for() in Flask routing?

It builds a URL for a given endpoint name (e.g. url_for('post', post_id=3)), avoiding hardcoded paths so links stay correct if routes change. Often used for redirects and template links.

What templating engine does Flask use, and what file extension do templates typically have?

Flask uses the Jinja2 templating engine, with templates stored in a 'templates/' folder and commonly using the .html extension.

What is the difference between Jinja2's {{ }} and {% %} delimiters?

{{ ... }} outputs/evaluates an expression (prints a value). {% ... %} runs a statement/control structure such as for-loops, if-conditions, and block/extends tags.

How does Jinja2 template inheritance work with base templates?

A base template defines {% block content %}{% endblock %} regions; child templates start with {% extends 'base.html' %} and override blocks with {% block content %}...{% endblock %}, reusing shared layout.

How do you loop over a list of posts in a Jinja2 template?

{% for post in posts %} ... {{ post.title }} ... {% endfor %}. The posts variable is passed from the view via render_template('home.html', posts=posts).

What is autoescaping in Jinja2 and why does it matter for a blog?

Jinja2 automatically escapes HTML in {{ }} output, converting characters like < and & to entities. This prevents XSS attacks from user-submitted content such as comments and post bodies.

Write the core fields of a Comment model linked to both a Post and a User.

class Comment(db.Model):\n id = db.Column(db.Integer, primary_key=True)\n content = db.Column(db.Text, nullable=False)\n date_posted = db.Column(db.DateTime, default=datetime.utcnow)\n post_id = db.Column(db.Integer, db.ForeignKey('post.id'), nullable=False)\n user_id = db.Column(db.Integer, db.ForeignKey('user.id'), nullable=False)

How do you model the one-to-many relationship between Post and Comment?

On Post: comments = db.relationship('Comment', backref='post', lazy=True). One post has many comments, and each comment's foreign key post_id references post.id.

Why do comments typically have two foreign keys in a blog schema?

A comment belongs to a specific post (post_id) and is authored by a specific user (user_id), so it needs foreign keys to both the Post and User tables.

How would you design a route that adds a comment to a specific post?

@app.route('/post/<int:post_id>/comment', methods=['POST']) — validate the form, create Comment(content=..., post_id=post_id, user_id=current_user.id), db.session.add + commit, then redirect back to the post.

How do you require login before allowing a user to submit a comment?

Decorate the comment route with @login_required so only authenticated users can post, and use current_user.id to attribute the comment to the logged-in user.

How are existing comments displayed within a single post's template?

Loop over the post's related comments: {% for comment in post.comments %} {{ comment.content }} by {{ comment.author.username }} {% endfor %}, accessing them via the backref relationship.

After redirecting from a successful comment submission, how do you confirm success to the user?

Use Flask's flash('Comment added!') before redirect, and render flashed messages in the template via get_flashed_messages(), giving user feedback under the Post/Redirect/Get pattern.

What is the Post/Redirect/Get (PRG) pattern and why use it after form submission?

After a successful POST, the server issues a redirect so the browser does a fresh GET. This prevents duplicate submissions when the user refreshes the page (e.g. double-posting a comment).

What is a WSGI server and why is the Flask built-in server not used in production?

WSGI (Web Server Gateway Interface) is the standard between Python web apps and servers. Flask's dev server is single-threaded and insecure; production uses WSGI servers like Gunicorn or uWSGI for performance and stability.

Name common hosting/deployment options for a Flask blog application.

Platform-as-a-Service like Heroku, Render, or PythonAnywhere; cloud providers like AWS (Elastic Beanstalk/EC2), Google Cloud, or Azure; often fronted by Nginx with a Gunicorn WSGI server.

What factors should guide choosing a hosting service for a Flask app?

Cost/free tier, ease of deployment, scalability, supported database options, custom domain and HTTPS support, and built-in CI/CD. Beginners often favor PaaS (Render, PythonAnywhere) for simplicity.

What is Gunicorn and how is a Flask app typically launched with it?

Gunicorn ('Green Unicorn') is a production WSGI HTTP server. Launch with: gunicorn app:app (module:Flask-instance), often configuring multiple worker processes for concurrency.

What is a Procfile and what does it specify for PaaS deployment?

A Procfile (used by Heroku/Render) declares the process types and commands to run, e.g. 'web: gunicorn app:app', telling the platform how to start the web server.

Why must DEBUG be disabled and SECRET_KEY be set securely before deploying to production?

Debug mode exposes an interactive console and stack traces enabling remote code execution. A weak/known SECRET_KEY lets attackers forge sessions and CSRF tokens. Both are critical production security settings.

How should secrets like SECRET_KEY and database URIs be supplied in production rather than hardcoding?

Read them from environment variables, e.g. SECRET_KEY = os.environ.get('SECRET_KEY'), keeping secrets out of source control and allowing per-environment configuration.

What is the recommended production database choice over SQLite for a deployed Flask blog, and why?

PostgreSQL (or MySQL). SQLite is file-based and poor for concurrent writes and multi-process servers, while PostgreSQL handles concurrency, scaling, and remote connections needed in production.