Django Cheat Sheet

01Scaffold & Runmanage.py

django-admin startproject config .
The trailing . avoids the classic nested config/config/ folder.★
python manage.py startapp books
One app per bounded concern. Then add it to INSTALLED_APPS — nothing works until you do.★
python manage.py runserver
Dev only. It says so out loud since 5.2, and it means it.★
python manage.py check
Static checks without touching the DB.
python manage.py shell
A REPL with Django loaded. Where you'll live while learning the ORM.★
python manage.py dbshell
Straight into the database client.

02Models — Fieldsmodels.py

models.CharField(max_length=200)
max_length is mandatory. TextField() for unbounded prose.★
models.DateTimeField(auto_now_add=True)
Set once on create. auto_now=True updates on every save.★
models.DecimalField(max_digits=8, decimal_places=2)
Money never goes in a FloatField.
models.SlugField(unique=True)
Also: EmailField, URLField, UUIDField, JSONField, BooleanField.
models.ImageField(upload_to="covers/")
Stores a path, not bytes. Needs MEDIA_ROOT and Pillow.
null=True vs blank=True
null = database may hold NULL. blank = forms may leave it empty. They are unrelated. On text fields, use blank=True alone.★

03Models — Relationsthe shape of your data

models.ForeignKey(Author, on_delete=models.CASCADE)
Many books → one author. on_delete is required — see the diagram below.★
ForeignKey(..., related_name="books")
Names the reverse accessor: author.books.all(). Without it you get book_set.★
models.ManyToManyField(Tag, blank=True)
Django creates the join table. Add through= to own it yourself.
models.OneToOneField(User, on_delete=models.CASCADE)
The classic user-profile extension.
class Meta: ordering = ["-created"]
Default sort, db_table, constraints, indexes, unique_together.
def __str__(self): return self.title
Always define it. Your admin and shell become readable instantly.★

04Migrationsmodels → schema

python manage.py makemigrations
Reads your models, writes a migration file. Commit it — it's source code.★
python manage.py migrate
Applies pending migrations to the database.★
python manage.py showmigrations
[X] applied, [ ] pending. The first thing to check when things look wrong.★
python manage.py sqlmigrate books 0002
Print the SQL without running it. Review before you touch production.
python manage.py migrate books 0001
Roll backwards to an earlier migration. zero unapplies them all.
python manage.py squashmigrations books 0012
Collapse a long history into one.
python manage.py migrate --fake
Marks migrations applied without running them. Lies to Django. Only for repairing a known-good schema.expert only

05ORM — ReadQuerySets

Book.objects.all()
A lazy QuerySet. No SQL runs until you iterate it.★
Book.objects.filter(year=2024)
Returns a QuerySet (chainable). .exclude() is the inverse.★
Book.objects.get(pk=7)
Returns one object — or raises DoesNotExist / MultipleObjectsReturned.★
Book.objects.filter(...).first()
Returns None instead of raising. Often what you actually wanted.
Book.objects.order_by("-created")
Minus = descending. "?" = random.
Book.objects.filter(...).exists()
Cheapest existence test. Never do len(qs) > 0.★
Book.objects.values_list("id", flat=True)
A flat list of scalars — no model instances built.

06ORM — Field Lookupsthe double underscore

filter(title__icontains="python")
Case-insensitive substring. __contains is case-sensitive.★
filter(year__gte=2020, year__lt=2025)
Comma = AND. Also __gt, __lte, __range=(a, b).★
filter(id__in=[1, 2, 3])
SQL IN. Accepts another QuerySet — becomes a subquery.
filter(author__country__name="India")
Traverse relations with __. Django writes the JOINs. Any depth.★
filter(cover__isnull=True)
Also __startswith, __year, __date, __regex.
filter(Q(a=1) | Q(b=2))
Q objects give you OR and NOT (~Q). Import from django.db.models.★
filter(sold__gt=F("stock"))
F() compares two columns in the database, no Python round-trip.

07ORM — Writecreate · update · delete

Book.objects.create(title="…")
Instantiate + save in one call.★
book.save()
INSERT if no pk, UPDATE if there is. save(update_fields=[...]) writes fewer columns.
Book.objects.get_or_create(isbn=x, defaults={...})
Returns (obj, created). The idempotent workhorse.★
Book.objects.bulk_create(objs)
One INSERT for thousands of rows. Skips save() and signals.★
Book.objects.filter(...).update(stock=F("stock")-1)
A single UPDATE. Bypasses save() and signals — that's the point, and the trap.
with transaction.atomic():
All-or-nothing. Wrap any multi-write operation.★
Book.objects.all().delete()
Deletes every row — and cascades to anything pointing at it.destructive

08ORM — Aggregate & Optimizewhere the wins are

.select_related("author")
One JOIN. For ForeignKey / OneToOne. Kills the N+1.★
.prefetch_related("tags")
A second query. For ManyToMany / reverse FK. Also kills the N+1.★
.annotate(n=Count("reviews"))
Adds a computed column per row. Then book.n.★
.aggregate(Avg("price"))
Collapses the whole QuerySet to one dict. Returns immediately.
.only("title") / .defer("body")
Fetch fewer columns. Touching a deferred field costs another query.
print(qs.query)
See the SQL Django built. .explain() asks the DB for its plan.★

09URLsurls.py

path("books/", views.book_list, name="book-list")
Always name your routes. Names are what reverse() and {% url %} need.★
path("books/<int:pk>/", views.detail, name="detail")
Converters: int, str, slug, uuid, path. The capture becomes a view kwarg.★
path("books/", include("books.urls"))
Mount an app's URLconf under a prefix. Root urls.py stays tiny.★
app_name = "books"
Namespaces the app. Reverse as "books:detail".
reverse("books:detail", kwargs={"pk": 7})
Build a URL from its name. Never hard-code a path.★
def get_absolute_url(self):
On the model. The admin and generic CBVs both pick it up for free.

10Views — Function-Basedexplicit & readable

render(request, "books/list.html", {"books": qs})
Template + context → HttpResponse. The bread and butter.★
get_object_or_404(Book, pk=pk)
Fetch or raise 404. Use it instead of bare .get() in a view.★
redirect("books:detail", pk=book.pk)
Takes a view name, a model with get_absolute_url, or a raw path.★
JsonResponse({"ok": True})
Sets the content type for you.
@login_required
Anonymous users bounce to LOGIN_URL. Also @permission_required, @require_POST.★
if request.method == "POST":
The canonical FBV form shape: POST → validate → redirect; otherwise render an empty form.

11Views — Class-Basedless code, more magic

ListView
model = Book → template books/book_list.html, context object_list. Add paginate_by.★
DetailView
Expects pk or slug in the URL → books/book_detail.html.★
CreateView / UpdateView / DeleteView
Set fields or form_class, plus success_url. Full CRUD in ~6 lines.★
def get_queryset(self):
The hook you'll override most. Scope by user, add select_related, filter.★
def get_context_data(self, **kwargs):
Call super() first, then add your extras.
class BookList(LoginRequiredMixin, ListView):
Mixins go first, left of the base view. MRO decides who runs.★
Book.as_view()
CBVs enter the URLconf as BookList.as_view(), never the bare class.

12TemplatesDTL

{{ book.title }}
Dot lookup tries dict key → attribute → list index. Calls callables with no args.★
{{ price|floatformat:2 }}
Filters: date, length, default, truncatewords, linebreaks, safe.★
{% for b in books %} … {% empty %} … {% endfor %}
{% empty %} saves you an {% if %}. Also forloop.counter.★
{% extends "base.html" %}
Must be the first tag in the file. Then override {% block %}s.★
{% url 'books:detail' book.pk %}
Reverse a route by name, in the template.★
{% load static %} … {% static 'css/app.css' %}
{% load %} must come before you use the tag.
{% csrf_token %}
Inside every POST form, or Django rejects it with a 403.★

13Formsvalidation, not HTML

class BookForm(forms.ModelForm):
Derives fields from the model. class Meta: model, fields.★
form = BookForm(request.POST)
Bound. Unbound is BookForm(). For file uploads add request.FILES.★
if form.is_valid():
Runs validation and populates form.cleaned_data. Check it before you trust anything.★
form.save(commit=False)
Get the unsaved instance so you can set obj.owner = request.user first.★
def clean_title(self):
Per-field validation. Plain clean() validates across fields.
fields = "__all__"
Convenient — and a mass-assignment risk. Prefer an explicit list.

14Adminfree CRUD

@admin.register(Book)
Decorator form, above your ModelAdmin class.★
list_display = ("title", "author", "year")
Columns in the changelist. Can include methods.★
list_filter = ("year",) · search_fields = ("title",)
Sidebar filters and a search box, free.★
list_select_related = ("author",)
The admin N+1 fix. Without it, a 100-row page fires 100 extra queries.
prepopulated_fields = {"slug": ("title",)}
Auto-slug as you type.
inlines = [ChapterInline]
Edit children on the parent's page.

15Auth & Userscontrib.auth

python manage.py createsuperuser
Your way into /admin/.★
get_user_model()
Never import User directly. And set AUTH_USER_MODEL to your own model before the first migration.★
login(request, user) / logout(request)
After authenticate(username=…, password=…).
request.user.is_authenticated
A property, not a method. Works in templates too.★
LoginRequiredMiddleware
Django 5.1+: login required by default, everywhere. Opt a view out with @login_not_required.
path("", include("django.contrib.auth.urls"))
Login, logout, password reset — all wired up for free.

16Settings & Staticconfig

INSTALLED_APPS += ["books"]
Without this, your models, templates and admin are invisible.★
STATIC_URL · STATICFILES_DIRS · STATIC_ROOT
Three different things. URL prefix · where you author · where collectstatic dumps.★
python manage.py collectstatic
Gathers every app's static files into STATIC_ROOT. A deploy step, not a dev one.★
MEDIA_ROOT / MEDIA_URL
User uploads. Separate from static, and never served by Django in production.
DEBUG = True
In production this leaks your settings, SQL and stack traces to the world.never in prod
python manage.py check --deploy
Run before every deploy. Audits DEBUG, HSTS, cookies, SECRET_KEY, ALLOWED_HOSTS.★

17Testing & Datamanage.py test

class BookTests(TestCase):
Each test runs in a transaction and is rolled back. A fresh DB every run.★
self.client.get("/books/")
A fake browser. assertEqual(r.status_code, 200), assertContains, assertRedirects.★
python manage.py test books.tests.BookTests
Narrow the run to a module, class or single method.
self.assertNumQueries(2)
Assert the query count. The regression test for an N+1.★
python manage.py dumpdata books > books.json
loaddata reads it back. Handy for fixtures and seeds.
python manage.py flush
Empties every table and re-runs the sync. Keeps the schema, destroys the data.destructive

18New in Django 6.0+tasks · CSP · partials

from django.tasks import task
Background Tasks (6.0). A built-in job framework — run work outside the request/response cycle, no Celery required.★
@task · fn.enqueue(...)
Decorate a function with @task, then .enqueue(...) to run it. Choose a backend via the TASKS setting.★
SECURE_CSP = {"default-src": [CSP.SELF]}
Built-in CSP (6.0). from django.utils.csp import CSP; add ContentSecurityPolicyMiddleware. Use SECURE_CSP_REPORT_ONLY to trial a policy.★
{% partialdef card %}…{% partial card %}
Template partials (6.0). Reusable inline fragments; load from anywhere as "page.html#card".
AsyncPaginator · AsyncPage
Async pagination (6.0) for async views — await the page and object-count access.

★Where Does My Code Go?the MTV decision

models.py
Business rules about data. Validation, computed properties, custom managers. Fat models.★
views.py
Request handling only. Take a request, pick data, choose a response. Thin views.★
forms.py
Validating user input. Not the model's job — untrusted data stops here.
templates/
Presentation only. If you need a loop with logic in it, do the work in the view.
urls.py
Routing only. No imports from models. Just names and paths.

django cheat sheet

The things that actually confuse people

The N+1 problem — and the two methods that kill it

Anatomy of a field lookup

QuerySets are lazy

`on_delete` — what happens to the children?

The migration loop

Project anatomy

Which generic view?

Worth memorizing