Python全栈之路-Django（十）

1 ORM补充

1.1 select_related & prefetch_related

from app01 import models


def test(request):
    # select_related 自动关联UserType表（inner join），能够关联多个
    q = models.UserInfo.objects.all().select_related('ut',)
    for row in q:
        print(row.name, row.ut.title)
    # prefetch_related 经过屡次单表查询解决连表查询效率低的问题
    # select * from userinfo;
    # Django内部：select * from usertype where id in [1,2,3]
    # Django将两个结果集整合在一块儿
    q = models.UserInfo.objects.all().prefetch_related('ut', )
    for row in q:
        print(row.name, row.ut.title)

    return HttpResponse('...')

1.2 多对多操做

app01.models.py

class Boy(models.Model):
    name = models.CharField(max_length=32)
    m = models.ManyToManyField('Girl')  # 多对多


class Girl(models.Model):
    nick = models.CharField(max_length=32)


# class Love(models.Model):
#     b = models.ForeignKey('Boy')
#     g = models.ForeignKey('Girl')
#     class Meta:
#         unique_together = [    # 联合惟一索引
#             ('b', 'g')
#         ]

app01.views.py

# 数据库操做
from app01 import models


def test(request):
    # # select_related 自动关联UserType表（inner join），能够关联多个
    # q = models.UserInfo.objects.all().select_related('ut',)
    # for row in q:
    #     print(row.name, row.ut.title)
    # # prefetch_related 经过屡次单表查询解决连表查询效率低的问题
    # # select * from userinfo;
    # # Django内部：select * from usertype where id in [1,2,3]
    # # Django将两个结果集整合在一块儿
    # q = models.UserInfo.objects.all().prefetch_related('ut', )
    # for row in q:
    #     print(row.name, row.ut.title)

    # 多对多
    # objs1 = [
    #     models.Boy(name='温艳杰'),
    #     models.Boy(name='杨振威'),
    #     models.Boy(name='苏浩智'),
    #     models.Boy(name='邹润成'),
    # ]
    # models.Boy.objects.bulk_create(objs1, 10)
    # objs2 = [
    #     models.Girl(nick='李智'),
    #     models.Girl(nick='韩星宇'),
    #     models.Girl(nick='秦镇'),
    #     models.Girl(nick='杨涵'),
    # ]
    # models.Girl.objects.bulk_create(objs2, 10)

    # models.Love.objects.create(b_id=1, g_id=1)
    # models.Love.objects.create(b_id=1, g_id=2)
    # models.Love.objects.create(b_id=2, g_id=4)
    # models.Love.objects.create(b_id=2, g_id=3)
    # models.Love.objects.create(b_id=3, g_id=3)
    # models.Love.objects.create(b_id=4, g_id=4)
    # models.Love.objects.create(b_id=4, g_id=2)

    # 1 和温艳杰有关联的姑娘的列表
    # 方法1：先找到该对象，而后经过反向操做获取girl相关信息
    # obj = models.Boy.objects.filter(name='温艳杰').first()
    # love_list = obj.love_set.all()
    # for row in love_list:
    #     print(row.g.nick)
    # 方法2： 遍历时跨表
    # love_list = models.Love.objects.filter(b__name='温艳杰')
    # for row in love_list:
    #     print(row.g.nick)
    # 方法3：values values_list
    # love_list = models.Love.objects.filter(b__name='温艳杰').values('g__nick')
    # for item in love_list:
    #     print(item['g__nick'])
    # love_list = models.Love.objects.filter(b__name='温艳杰').values_list('g__nick')
    # for item in love_list:
    #     print(item[0])
    # 方法4：select_related
    # love_list = models.Love.objects.filter(b__name='温艳杰').select_related('g')
    # for obj in love_list:
    #     print(obj.g.nick)

    # 2 查看和韩星宇有关系的男生
    # 方法1：
    # obj = models.Girl.objects.filter(nick='韩星宇').first()
    # love_list = obj.love_set.all()
    # for row in love_list:
    #     print(row.b.name)
    # 方法2：
    # love_list = models.Love.objects.filter(g__nick='韩星宇')
    # for row in love_list:
    #     print(row.b.name)
    # 方法3：
    # love_list = models.Love.objects.filter(g__nick='韩星宇').values('b__name')
    # for item in love_list:
    #     print(item['b__name'])
    # love_list = models.Love.objects.filter(g__nick='韩星宇').values_list('b__name')
    # for item in love_list:
    #     print(item[0])
    # 方法4：
    # love_list = models.Love.objects.filter(g__nick='韩星宇').select_related('b')
    # for obj in love_list:
    #     print(obj.b.name)
    #

    # ManyToManyField 会生成app01_boy_m表，即boy和girl关系表
    # 正向操做
    obj = models.Boy.objects.filter(name='温艳杰').first()
    print(obj.id, obj.name)
    # 往app01_boy_m添加与obj对象有关系的列
    # obj.m.add(3)     # 单值
    # obj.m.add(2, 4)  # 多值
    # obj.m.add(*[1,])   # 列表
    # 在关系表中删除与obj对象有关系的列
    # obj.m.remove(1)
    # obj.m.remove(2, 4)
    # obj.m.remove(*[3])
    # 重置
    # obj.m.set([3, 1, ])
    # 获取与obj有关系的女孩列表
    girl_list = obj.m.all().filter(nick='李智')  # q是girl对象
    for item in girl_list:
        print(item.nick)
    # 在关系表中删除全部与obj有关系的列
    # obj.m.clear()

    # 反向操做：
    obj = models.Girl.objects.filter(nick='韩星宇').first()
    print(obj.id, obj.nick)
    v = obj.boy_set.all()  # boy对象
    print(v)

    return HttpResponse('...')

2 CSRF

给用户生成一段随机字符串，用户提交数据时须要携带，不然返回403状态码，用于防范XSS攻击

<form action="/csrf1.html" method="post">
    {% csrf_token %}
    <input type="text">
    <input type="submit" value="提交">
</form>

不只会写到form表单里，cookie里也会写入

全站禁用

# 'django.middleware.csrf.CsrfViewMiddleware',

局部禁用

from django.views.decorators.csrf import csrf_exempt,csrf_protect

@csrf_exempt  # 局部禁用
def csrf1(request):
    if request.method == 'GET':
        return render(request, 'csrf1.html')
    else:
        return HttpResponse('...')

局部应用：

from django.views.decorators.csrf import csrf_exempt,csrf_protect

@csrf_protect  # 局部使用
def csrf1(request):
    if request.method == 'GET':
        return render(request, 'csrf1.html')
    else:
        return HttpResponse('...')

2.1 ajax提交数据时携带CSRF

方法1：

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Title</title>
</head>
<body>
<form action="/csrf1.html" method="post">
    {% csrf_token %}
    <input type="text" id="user">
    <input type="submit" value="提交">
    <input type="button" value="Ajax提交" onclick="submitForm();">
</form>
<script src="/static/jquery-3.2.1.min.js"></script>
<script>
    function submitForm() {
        var csrf = $('input[name=csrfmiddlewaretoken]').val();
        var user = $('#user').val();
        $.ajax({
            url:'csrf1.html',
            type: 'POST',
            data: {'user': user, 'csrfmiddlewaretoken': csrf},
            success:function (arg) {
                console.log(arg)
            }
        })
    }
</script>
</body>
</html>

方法2：

function submitForm() {
        var token = $.cookie('csrftoken')
        var user = $('#user').val();
        $.ajax({
            url:'csrf1.html',
            type: 'POST',
            headers:{'X-CSRFToken': token},
            data: {'user': user},
            success:function (arg) {
                console.log(arg)
            }
        })
    }

3 CBV补充

CBV应用装饰器（注：对于CSRF目前只能在类上加装饰器）

# 1.类上加装饰器
@method_decorator(csrf_exempt,name='dispatch')
class Foo1(View):
    def get(self,request):
        pass
    def post(self,request):
        pass
# 2.指定方法上加
class Foo2(View):
    @method_decorator(wrapper)
    def get(self,request):
        pass
    def post(self,request):
        pass