Early PCEW cheat sheet for Python web request flow, routing, forms, templates, validation, sessions, and basic web security.
Use this cheat sheet as an early review for PCEW-30-0x: Certified Entry-Level Web Developer with Python. Python Institute lists PCEW as work in progress, so this page focuses on stable entry-level Python web-development fundamentals rather than final exam weights.
flowchart TD
B["Browser sends HTTP request"] --> R["Route matches URL and method"]
R --> V["Server validates input"]
V --> L["Handler runs application logic"]
L --> D["Data access reads or writes state"]
D --> T["Template renders escaped output"]
T --> S["Server returns HTTP response"]
If a question involves web behavior, locate the boundary first: request, route, input, application logic, data, template, session, or response.
| Concept | Strong answer | Weak answer |
|---|---|---|
| HTTP method | Use GET for safe reads and POST/appropriate methods for changes. |
Change server state through a bookmarked GET URL. |
| Status code | Return codes that match the result: success, redirect, client error, or server error. | Return success even when validation failed. |
| Routing | Keep URL matching clear and validate route parameters. | Let arbitrary path values reach file or database operations. |
| Form validation | Validate on the server even if the browser validates too. | Trust client-side validation. |
| Templates | Escape untrusted data before rendering HTML. | Render raw user input into a page. |
| Sessions | Store only necessary state and protect session cookies. | Put secrets or large sensitive data in the client. |
| Errors | Show safe messages to users and detailed records to logs. | Expose stack traces or database errors in the browser. |
| Trap | Safer habit |
|---|---|
| Cross-site scripting | Escape output and avoid rendering untrusted HTML. |
| SQL or command injection | Use parameterized APIs and avoid string-built commands. |
| CSRF | Protect state-changing forms with CSRF defenses where the framework supports them. |
| Weak sessions | Use secure cookie settings and avoid storing secrets client-side. |
| Hard-coded secrets | Keep secrets out of source code and logs. |
| Broad file paths | Normalize and restrict paths before reading or writing files. |
| Area | What to be able to explain |
|---|---|
| Request parsing | Where URL, query string, headers, cookies, body, and form fields come from. |
| Routing | How the framework maps a request to a handler function. |
| Validation | Why every external input must be checked server-side. |
| Templates | How presentation is separated from application logic. |
| Persistence | How a handler deals with missing, failed, or duplicate data operations. |
| Authentication | Why login is not enough without session protection and authorization checks. |
| Deployment basics | Why debug mode, secrets, and error pages must change outside development. |