Hello, tech enthusiasts! \ud83d\udc4b<\/p>\n\n\n\n
Your team sends long links all the time: in SMS messages, in printed flyers, in emails. A link like An online service could do it, but then someone else holds your links and click numbers. Today we build our own in one Python file!<\/p>\n\n\n\n A web framework is like a ready kitchen: the stove and the pots are there, you only cook the food.<\/p>\n\n\n\n Our app does four things:<\/p>\n\n\n\n One safety rule: if any link can be shortened, spammers will use your domain to hide bad websites. So we only allow targets on our own domains<\/strong>.<\/p>\n\n\n\n Create a file called A few notes:<\/p>\n\n\n\n Set a long password, then start the app:<\/p>\n\n\n\nhttps:\/\/www.example.com\/offers\/summer\/2026\/product-page?ref=flyer<\/a><\/code> is hard to type and looks messy. A short link like https:\/\/go.example.com\/Xy7a9Q<\/a><\/code> is much nicer.<\/p>\n\n\n\nWhat you need<\/h3>\n\n\n\n
\n
pip install flask<\/code><\/li>\n\n\nStep 1: The plan<\/h3>\n\n\n\n
\n
Step 2: The code<\/h3>\n\n\n\n
app.py<\/code>:<\/p>\n\n\n\nimport hmac\nimport os\nimport secrets\nimport sqlite3\nfrom urllib.parse import urlparse\n\nfrom flask import Flask, Response, abort, g, redirect, request\nfrom markupsafe import escape\n\napp = Flask(__name__)\nDB_FILE = \"links.db\"\n# Only links to these sites can be shortened\nALLOWED_HOSTS = {\"example.com\", \"www.example.com\", \"shop.example.com\"}\nADMIN_PASSWORD = os.environ.get(\"ADMIN_PASSWORD\", \"\")\n\n\ndef init_db():\n with sqlite3.connect(DB_FILE) as conn:\n conn.execute(\"\"\"CREATE TABLE IF NOT EXISTS links (\n code TEXT PRIMARY KEY,\n target TEXT NOT NULL,\n clicks INTEGER NOT NULL DEFAULT 0)\"\"\")\n\n\ndef db():\n # One database connection per request\n if \"db\" not in g:\n g.db = sqlite3.connect(DB_FILE)\n g.db.row_factory = sqlite3.Row\n return g.db\n\n\n@app.teardown_appcontext\ndef close_db(error):\n conn = g.pop(\"db\", None)\n if conn is not None:\n conn.close()\n\n\ndef is_admin():\n auth = request.authorization\n if not ADMIN_PASSWORD or auth is None or auth.password is None:\n return False\n # compare_digest is safe against timing attacks\n return hmac.compare_digest(auth.password.encode(), ADMIN_PASSWORD.encode())\n\n\ndef target_ok(url):\n parts = urlparse(url)\n return parts.scheme in (\"http\", \"https\") and parts.hostname in ALLOWED_HOSTS\n\n\n@app.route(\"\/admin\", methods=[\"GET\", \"POST\"])\ndef admin():\n if not is_admin():\n return Response(\"Login required\", 401,\n {\"WWW-Authenticate\": 'Basic realm=\"admin\"'})\n message = \"\"\n if request.method == \"POST\":\n target = request.form.get(\"target\", \"\").strip()\n if not target_ok(target):\n message = \"Only links to our own websites are allowed.\"\n else:\n for _ in range(5): # try again if the random code already exists\n code = secrets.token_urlsafe(4)\n try:\n db().execute(\"INSERT INTO links (code, target) VALUES (?, ?)\",\n (code, target))\n db().commit()\n message = f\"Short link: {request.host_url}{code}\"\n break\n except sqlite3.IntegrityError:\n continue\n rows = db().execute(\n \"SELECT code, target, clicks FROM links ORDER BY clicks DESC\").fetchall()\n items = \"\".join(\n f\"<li>{escape(r['code'])} → {escape(r['target'])} ({r['clicks']} clicks)<\/li>\"\n for r in rows)\n return f\"\"\"<h1>Link shortener<\/h1>\n<p>{escape(message)}<\/p>\n<form method=\"post\">\n <input name=\"target\" size=\"60\" placeholder=\"https:\/\/www.example.com\/page\">\n <button>Shorten<\/button>\n<\/form>\n<ul>{items}<\/ul>\"\"\"\n\n\n@app.route(\"\/<code>\")\ndef follow(code):\n row = db().execute(\"SELECT target FROM links WHERE code = ?\", (code,)).fetchone()\n if row is None:\n abort(404)\n db().execute(\"UPDATE links SET clicks = clicks + 1 WHERE code = ?\", (code,))\n db().commit()\n return redirect(row[\"target\"], code=302)\n\n\ninit_db()\n\nif __name__ == \"__main__\":\n app.run()<\/code><\/pre>\n\n\n\n\n
secrets.token_urlsafe(4)<\/code> makes a random code of about 6 letters and numbers, like Xy7a9Q<\/code>.<\/li>\n\n\n?<\/code> marks in the SQL keep the database safe from “SQL injection”, a trick where an attacker hides commands inside the text.<\/li>\n\n\nescape()<\/code> stops anyone from putting HTML or scripts into your admin page.<\/li>\n\n\nurlparse(...).hostname<\/code> reads the real site name. So a tricky link like https:\/\/example.com@bad-site.test<\/a><\/code> is blocked, because its real host is bad-site.test<\/code>.<\/li>\n\n<\/ul>\n\n\n\nStep 3: Run it<\/h3>\n\n\n\n
export ADMIN_PASSWORD='choose-a-long-random-password'\npython app.py<\/code><\/pre>\n\n\n\n