Recent from talks
Contribute something
Nothing was collected or created yet.
Web2py
View on WikipediaThis article may contain excessive or inappropriate references to self-published sources. (April 2024) |
| web2py Enterprise Web Framework | |
|---|---|
![]() web2py logo | |
| Original author | Massimo Di Pierro |
| Initial release | September 27, 2007 |
| Stable release | 3.1.1[1] |
| Repository | Web2py Repository |
| Written in | Python |
| Platform | Cross-platform |
| Type | Web application framework |
| License | GNU Lesser General Public License version 3 (LGPLv3) |
| Website | www.web2py.com |
Web2py is an open-source web application framework written in the Python programming language. Web2py allows web developers to program dynamic web content using Python. Web2py is designed to help reduce tedious web development tasks, such as developing web forms from scratch, although a web developer may build a form from scratch if required.[2]
Web2py was originally designed as a teaching tool with emphasis on ease of use and deployment. Therefore, it does not have any project-level configuration files. The design of web2py was inspired by the Ruby on Rails and Django frameworks. Like these frameworks, web2py focuses on rapid development, favors convention over configuration approach and follows a model–view–controller (MVC) architectural pattern.
Overview
[edit]Web2py is a full-stack framework in that it has built-in components for all major functions, including:
- HTTP requests, HTTP responses, cookies, sessions;
- multiple protocols[3] HTML/XML, REST, ATOM and RSS, RTF and CSV, JSON, JSON-RPC and XML-RPC, AMF-RPC (Flash/Flex), and SOAP;[4]
- CRUD API;
- multiple authentication mechanisms and role-based access control;
- database abstraction layer (DAL) that dynamically generates SQL and runs on multiple compatible database backends;
- RAM, disk, and memcached-based caching for scalability;
- internationalization support;
- jQuery for Ajax and UI effects;
- automatic logging of errors with context.
Web2py encourages sound software engineering practices such as
- the model–view–controller (MVC) pattern;
- self-submission[5] of web forms;
- server-side sessions;
- safe handling of uploaded files.
Web2py uses the WSGI protocol, the Python-oriented protocol for communication between web server and web applications. It also provides handlers for CGI and the FastCGI protocols, and it includes the multi-threaded, SSL-enabled Rocket[6] wsgiserver.
Distinctive features
[edit]Web-based integrated development environment (IDE)
[edit]All development, debugging, testing, maintenance and remote database administration can (optionally) be performed without third-party tools, via a web interface, itself a web2py application. Internationalization (adding languages and writing translations) can also be performed from this IDE. Each application has an automatically generated database administrative interface, similar to Django. The web IDE also includes web-based testing.
Applications can also be created from the command line or developed with other IDEs.[7] Further debugging options:[8]
- Wing IDE allows graphical debugging of web2py applications[9] as you interact with it from your web browser, you can inspect and modify variables, make function calls etc.
- Eclipse/PyDev — Eclipse with the Aptana PyDev plugin — supports web2py as well.[10][11]
- The extensible pdb debugger is a module of Python's standard library.
- With the platform-independent open-source Winpdb debugger, one can perform remote debugging[12] over TCP/IP, through encrypted connection.[13]
The Hello World program with web2py in its simplest form (simple web page[14] with no template) looks like:
def hello():
return 'Hello World'
Web2py includes pure Python-based template language, with no indentation requirements and a server-side Document Object Model (DOM). The template system works without web2py.[15] Joomla 1.x templates can be converted to web2py layouts.[16]
Web2py also includes two markup libraries: the markdown2 text-to-HTML filter, which converts Markdown markup to HTML on the fly; and markmin which is inspired by markdown but supports tables, html5 video/audio and oembed protocol.
A controller without a view automatically uses a generic view that render the variables returned by the controller, enabling the development of an application's business logic before writing HTML. The "Hello World" example using a default template:
def hello():
return dict(greeting='Hello World')
The dict() output of an action is automatically rendered in HTML if the page is request with a .html extension, in JSON if the page is requested with a .json extension, in XML if requested with .xml. It supports other protocols including jsonp, rss, ics, google maps, etc. and is extensible.
Here is a more complex code example which defines a table, and exposes a grid to logged in users:
db.define_table('thing',Field('name',notnull=True))
@auth.requires_login()
def hello():
return dict(grid = SQLFORM.grid(db.thing))
Ticketing system
[edit]Each web2py application comes with a ticketing system:
- If an error occurs, it is logged and a ticket is issued to the user. That allows error tracking.
- Errors and source code are accessible only to the administrator, who can search and retrieve errors by date or client-IP. No error can result in code being exposed to the users.
Portable cron
[edit]Cron is a mechanism for creating and running recurrent tasks in background. It looks for an application-specific crontab file which is in standard crontab format. Three modes of operation are available:
- Soft cron: cron routines are checked after web page content has been served, does not guarantee execution precision. For unprivileged Apache CGI/WSGI installs.
- Hard cron: a cron thread gets started on web2py startup. For Windows and Rocket/standalone web2py installs.
- System cron: cron functions get force-called from the command line, usually from the system crontab. For Unix/Linux systems and places where the cron triggers need to be executed even if web2py is not running at the moment; also good for CGI/WSGI installs if you have access to the system crontab.
Scheduler
[edit]Since version 2.3 the use of cron is discouraged since web2py comes with a master/worker scheduler. Jobs can be defined in models and are scheduled by creating an entry in the database. Users can start work processes who pickup and execute tasks in background. The schedule is better than cron because it allows to specify more parameters (start time, stop time, number of repetitions, number of trials in case of error) and do a better job at running within constant resource utilization.
Bytecode distribution
[edit]Web2py can compile web applications for distribution in bytecode compiled form, without source code. Unlike frameworks that use specialized template languages for their views, Web2py can also compile the view code into bytecode, since it is pure Python code.
Global Environment
[edit]This article needs additional citations for verification. (November 2013) |
Web2py is unique in the world of Python web frameworks because models and controllers are executed, not imported. They are not modules. They are executed in a single global environment which is initialized at each HTTP request. This design decision has pros and cons.
The major pro is the ease of development, specifically for rapid prototyping. Another pro is that all the objects defined within this environment are cleanly reset at each HTTP request and never shared across requests. This means the developer does not need to worry about changing the state of an object (for example the readable attribute of a database field) or worry about a change leaking to other concurrent requests or other applications. A third advantage is that web2py allows the coexistence of multiple applications under the same instance without conflicts even if they use different versions of the same modules or different modules with the same name.
The main disadvantage of the global environment is that model files and controller files are not modules and the order of execution matters (although it can be specified using conditional models). Naming conflict is more likely to occur than in normal Python modules. Some standard Python development tools may not understand objects defined in models and controllers. Moreover, developers must be aware that code in models is executed at every request and this may cause a performance penalty. Nothing in web2py prevents developers from using and importing normal Python modules (model-less approach) and for this purpose web2py provides a thread local object (current) to facilitate access to objects associated to the current request. Yet, in this case, the developer has to be aware of the same pitfalls that other frameworks incur: changing the state of an object defined in a module may affect other concurrent requests.
Another con is that, because models and controllers are not class-based, efficient code reuse becomes more difficult, particularly as the inability to inherit from a parent controller (e.g. the ApplicationController in Ruby on Rails) means that common controller functionality must be referenced repeatedly across all controller files.
Supported environments
[edit]Operating systems, Python versions & implementations, virtual machines, hardware
[edit]web2py runs on Windows, Windows CE phones, Mac, Unix/Linux, Google App Engine, Amazon EC2, and almost any web hosting via Python 2.7/3.5/3.6/pypy.[2]
The current binary version of web2py (for Windows or Mac) includes Python 2.7, but the source version can be run on 2.7 and 3.5+. Support for Python 2.6 has been dropped on 2017.
web2py since v1.64.0 runs unmodified on Java with Jython 2.5, without any known limitation.[17]
web2py code can run with IronPython on .NET.[18] Limitations:
- no csv module (so no database I/O);
- no third party database drivers (not even SQLite, so no databases at all);
- no built-in web server (unless you cripple it by removing signals and logging).
The web2py binary will[19] run from a USB drive or a portable hard drive without dependencies, like Portable Python.
Web servers
[edit]Web2py can service requests via HTTP and HTTPS with its built-in Rocket server,[20] with Apache,[21] Lighttpd,[22] Cherokee,[23] Hiawatha, Nginx and almost any other web server through CGI, FastCGI, WSGI, mod_proxy,[24][25][26] and/or mod_python.
IDEs and debuggers
[edit]While a number of web2py developers use text editors such as Vim, Emacs or TextMate Web2py also has a built-in web-based IDE. Others prefer more specialized tools providing debugging, refactoring, etc.
- Aptana Studio with integrated PyDev
- Eclipse with PyDev
- Eric with built-in debugger.[27]
- Wing IDE[28]
- Microsoft Visual Studio with Python Tools for Visual Studio
- Pycharm3 has Web2py framework support
Database handling
[edit]The database abstraction layer (DAL) of web2py dynamically and transparently generates SQL queries and runs on multiple compatible database backend without the need for database-specific SQL commands (though SQL commands can be issued explicitly).
SQLite is included in Python and is the default web2py database. A connection string change allows connection to Firebird, IBM Db2, Informix, Ingres, Microsoft SQL Server, MySQL, Oracle, PostgreSQL, and Google App Engine (GAE) with some caveats. Specialities:
- Multiple database connections.
- Automatic table creates and alters.
- Automatic transactions.
- Distributed transactions:
- Since web2py v1.17 with PostgreSQL v8.2 and later,[29][30] because it provides API for two-phase commits.
- Since web2py v1.70.1 with Firebird and MySQL (experimental).
- GAE is not a relational store, but web2py emulates certain operations.
The DAL is fast, at least comparable with SQLAlchemy and Storm.[31]
Web2py implements a DAL, not an ORM. An ORM maps database tables into classes representing logical abstractions from the database layer (e.g., a User class or a PurchaseOrder class), and maps records into instances of those classes. The DAL instead maps database tables and records into instances of classes representing sets and records instead of higher-level abstractions. It has very similar syntax to an ORM but it is faster, and can map almost any SQL expressions into DAL expressions. The DAL can be used independently of the rest of web2py.[32]
Here are some examples of DAL syntax:
db = DAL("postgresql://user:pass@localhost/db", pool_size=10)
db.define_table("person", Field("name"), Field("image", "upload"))
db.person.insert(name="Martin", image=open("filename.png"))
rows = db((db.person.name == "Martin") | db.person.name.contains("T")).select(
orderby=db.person.name.lower()
)
The latest version of the DAL has support for 2D GIS functions with Spatialite and PostGIS. The current API are experimental because of a possible move to 3D APIs.
Automatic database migrations
[edit]web2py supports database migrations—change the definition of a table and web2py ALTERs the table accordingly. Migrations are automatic, but can be disabled for any table, and migration is typically disabled when an application is ready for live distribution. Migrations and migration attempts are logged, documenting the changes.
Limitations:
- SQLite cannot alter table and change a column type, but rather simply stores new values according to the new type.
- GAE has no concept of alter-table, so migrations are limited.
Licenses
[edit]Web2py code is released under GNU Lesser General Public License (LGPL) version 3 as of web2py version 1.91.1.[33]
Web2py code before version 1.91.1 was released under GNU GPL v2.0 with commercial exception.
Various third-party packages distributed with web2py have their own licenses, generally public domain, MIT or BSD-type licenses. Applications built with web2py are not covered by the LGPL license.
Web2py is copyrighted by Massimo DiPierro. The web2py trademark is owned by Massimo DiPierro.
Awards
[edit]In 2011 InfoWorld ranked web2py highest among the top six Python web frameworks, awarded web2py the Bossie award 2011 for best open source application development software. In 2012 web2py won the InfoWorld Technology of the Year award.[34][35]
Publications
[edit]web2py Book
[edit]The base web2py documentation is The Official web2py Book, by Massimo DiPierro. The manual is a full web2py application and it's freely available online,[36] in PDF format or printed form.
- 1st Edition: out of print. Wiley; September 16, 2008; 256 pages; ISBN 978-0-470-43232-7.
- 2nd Edition: web2py Manual. Wiley; August 26, 2009; 341 pages; ISBN 978-0-470-59235-9.
- 3rd Edition: Lulu; September 25, 2010 357 pages.
- 4th Edition: Lulu; December 9, 2011 583 pages.
- 5th Edition: PDF Copy; March 3, 2013 614 pages; ISBN 978-0-578-12021-8.
- latest online sources: on GitHub[37]
Online documentation
[edit]Online documentation is linked from the web2py home page, with cookbook, videos, interactive examples, interactive API reference, epydoc s (complete library reference), FAQ, cheat sheet, online tools etc.
- Cheat sheet for web2py.
- web2pyslices, recipes posted using the movuca social network in web2py.
- Crash Course in Web2py (5-part series).
- Web2py slides (old).
Videos
[edit]- web2py Enterprise Web Framework Tutorial.
- web2py "Shootout" video tutorial.
- web2py on the Google appengine.
- web2py: Create, edit, and deploy a basic web app.
Printed
[edit]- "web2py application development cookbook", Packt, 2012
- Web programming with web2py; Python Magazine; Marco Tabini & Associates, Inc.; June 2008
Background
[edit]Developers
[edit]The lead developer of web2py is Massimo DiPierro, an associate professor of Computer Science at DePaul University in Chicago. As of 2011, the web2py homepage lists over 70 "main contributors".[38]
Development source code
[edit]The web2py development source code is available from the main repository:
Third-party software included in web2py
[edit]- Python-based components:
- Rocket, a fast, HTTP/1.1-compliant, multi-threaded, SSL-enabled and streaming-capable WSGI server;
- fcgi.py: a FastCGI/WSGI gateway;
- Login API for Janrain, Dropbox, Google, LDAP, PAM, X509, CAS, OpenID, OAuth 1&2, Loginza
- simplejson: a simple, fast, complete, correct and extensible JSON encoder and decoder;
- markdown2: a Markdown processor;
- fpdf a library for PDF generation;
- PyRTF: an RTF document generator;
- a syntax highlighter;
- pysimplesoap for SOAP services;
- PyRSS2Gen: an RSS generator;
- feedparser: to parse RSS and Atom feeds.
- JavaScript-based components:
- jQuery: a lightweight JavaScript library;
- CodeMirror: a free editor for source code;
- C-based components:
- SQLite: a relational database;
- memcached: a general-purpose distributed memory caching system.
- Payment API for Authorize.Net, Google Wallet, Stripe.com
History and naming
[edit]The source code for the first public version of web2py was released under GNU GPL v2.0 on 2007-09-27 by Massimo DiPierro as the Enterprise Web Framework (EWF). The name was changed twice due to name conflicts: EWF v1.7 was followed by Gluon v1.0, and Gluon v1.15 was followed by web2py v1.16. The license was changed to LGPLv3 as of web2py version 1.91.1 on 2010-12-21.
Applications built on Web2py
[edit]Notes
[edit]- ^ "Web2PyWeb Framework".
- ^ a b "What is web2py?". web2py.com. Web2py. Retrieved 2023-10-31.
- ^ Web2py speaks multiple protocols since v1.63
- ^ Using SOAP with web2py
- ^ Writing Smart Web-based Forms
- ^ Rocket Web Server
- ^ Web2py online IDE with It's All Text![permanent dead link] Firefox addon and Ulipad (open source Python IDE)
- ^ How to debug Web2py applications?
- ^ Wing IDE supports debugging for web2py
- ^ Eclipse/PyDev supports debugging for web2py
- ^ Using web2py on Eclipse
- ^ "With Winpdb one can do remote debugging over TCP/IP". Archived from the original on 2015-11-09. Retrieved 2009-10-31.
- ^ "Encrypted communication in Winpdb". Archived from the original on 2015-11-09. Retrieved 2009-10-31.
- ^ Simplest web page with web2py: "Hello World" example
- ^ How to use web2py templates without web2py
- ^ Using Joomla templates with web2py
- ^ Web2py runs fully on Java and J2EE using Jython
- ^ Web2py runs with IronPython on .NET, with limitations
- ^ MySQL with web2py Windows binary on a USB thumb-drive
- ^ How to run the built-in SSL server
- ^ Web2py with Apache and mod_ssl
- ^ Web2py with Lighttpd and FastCGI
- ^ Web2py with Cherokee
- ^ Apache Module mod_proxy
- ^ Web2py with mod_proxy
- ^ Web2py with mod_proxy and mod_proxy_html
- ^ Eric IDE Project
- ^ Using Wing IDE with web2py
- ^ "Distributed transactions with PostgreSQL". Archived from the original on 2009-04-14. Retrieved 2009-10-30.
- ^ Distributed transactions with PostgreSQL — further details
- ^ ORM Benchmark
- ^ How to use web2py DAL without web2py
- ^ web2py License Agreement
- ^ Grehan, Rick. "Pillars of Python: Six Python Web frameworks compared". InfoWorld. Retrieved 2017-11-30.
- ^ staff, InfoWorld Reviews. "InfoWorld's 2012 Technology of the Year Award winners". InfoWorld. Retrieved 2017-11-30.
- ^ "web2py - The official manual online". web2py.com. Retrieved 2018-11-14.
- ^ "web2py/web2py-book". GitHub. Retrieved 2018-11-14.
- ^ List of main contributors to web2py
External links
[edit]Web2py
View on GrokipediaIntroduction
Overview
web2py is a free, open-source full-stack web framework written in Python, designed for the agile development of secure, database-driven web applications.[1] It emphasizes rapid prototyping and deployment, enabling developers to build dynamic web content without extensive setup. Initially released in October 2007, web2py follows a Model-View-Controller (MVC) architecture to streamline the creation of scalable applications.[1] Adopting a "batteries included" philosophy, web2py provides essential tools out of the box, including a built-in multi-threaded Rocket WSGI web server for handling HTTP requests, support for multiple SQL databases such as SQLite, MySQL, and PostgreSQL, and a web-based Integrated Development Environment (IDE) for editing code, managing databases, and deploying applications directly through a browser.[1] Core components like the Database Abstraction Layer (DAL) offer ORM-like functionality for database interactions, while built-in CRUD scaffolding allows quick generation of forms and interfaces for data management.[1] The framework's design prioritizes ease of use with no installation or configuration files required, security by default through automatic input validation, output escaping to prevent cross-site scripting (XSS) and injection attacks, and cross-site request forgery (CSRF) protection, alongside scalability via support for multiple applications per instance and background task execution.[1] It ensures portability across platforms, running on CPython and PyPy interpreters for Python 2.7 and 3.5+, as well as operating systems like Windows, macOS, Linux, and cloud environments such as Google App Engine and Amazon EC2.[1]Current Status
As of November 2025, the latest stable release of web2py is version 3.0.12, timestamped September 6, 2025, which includes minor updates focused on stability and compatibility enhancements.[4] This version maintains the framework's core architecture while addressing lingering issues from prior iterations. Web2py receives ongoing limited support, primarily through bug fixes, but it is officially not recommended for new developments due to its aging design and lack of modern features like asynchronous processing.[4] The successor framework, py4web, has been introduced as a more efficient alternative optimized for Python 3.x projects, with easier porting options for existing web2py applications.[5] No full end-of-life has been announced, though migration to py4web is emphasized for better integration with contemporary Python ecosystems, including async capabilities.[3] Regarding Python compatibility, version 2.27.1 is the last to provide full support for Python 2.7. As of version 3.0.12, web2py supports Python 3.9 and later, with support for earlier Python 3 versions and Python 2 discontinued.[3] The community remains active via the GitHub repository (web2py/web2py), where bug fixes continue, though commit frequency has been low since 2020 with sporadic updates tied to releases.[3] User groups and forums, including the py4web Google Group, provide legacy support and migration guidance.[4]History
Origins and Development
web2py was created by Massimo Di Pierro, a physicist with a PhD in high energy physics from the University of Southampton and a full professor in the School of Computing at DePaul University in Chicago.[6][7] Di Pierro developed the framework starting in 2007 as a personal project to address challenges in teaching server-side web development and supporting research needs in academic and scientific settings, aiming to make building secure, database-driven web applications as straightforward as developing desktop software for non-experts.[1][7] The initial version 1.0, released in October 2007, introduced core elements such as the web-based administrative interface, reflecting Di Pierro's emphasis on zero-configuration deployment and rapid prototyping for collaborative scientific data sharing and communication over the internet.[1] This release was licensed under GPL2 with a commercial exception, establishing an open-source model that encouraged adoption in educational and research environments, including U.S. Department of Energy projects.[7] web2py drew on Python's simplicity and principles like DRY (Don't Repeat Yourself), while incorporating Web 2.0 concepts for interactive applications; it also borrowed ideas from Ruby on Rails, such as convention-over-configuration and scaffolding for quick app generation, but adapted them into a Pythonic database abstraction layer (DAL) to ensure database neutrality without vendor lock-in.[1][8] The source code is hosted on GitHub under the repository web2py/web2py, following a migration from the original Mercurial repository on Google Code around 2012, operating as a free and open-source full-stack framework programmable in Python.[3][9] Development follows a Git-based workflow where contributors fork the repository, work on feature or issue branches, and submit pull requests; a key practice involves rebasing to rewrite commit history, collapsing multiple commits into cleaner ones for stable releases and maintaining a tidy master branch separate from the development trunk.[9] This process supports backward compatibility from the earliest versions and facilitates community contributions while preserving the framework's focus on security and ease for scientific and educational use.[1]Naming and Milestones
The name "web2py" reflects the Web 2.0 paradigm, in which the web functions as the central platform for computing and development, underscoring the framework's emphasis on simplicity and accessibility for Python-based web applications.[1] web2py's development began with its initial public release in October 2007 by physicist and software developer Massimo Di Pierro, initially as a teaching tool for server-side web programming.[1] An early pivotal event was the integration of jQuery core libraries starting in version 1.28, enhancing client-side interactivity without requiring external dependencies.[10] Compatibility with Google App Engine was added in version 1.30, facilitating widespread adoption for cloud-deployed applications around 2010.[11] The framework reached peak popularity between 2011 and 2012, highlighted by the 2011 Bossie Award for best open-source development software and the 2012 InfoWorld Technology of the Year award, which recognized its maturity in rapid, secure web development.[2] In version 1.91.1, the license shifted from GPLv2 with a commercial exception to LGPLv3, broadening its commercial usability.[11] Version evolution progressed from the 1.x series, which provided basic scaffolding for database-driven apps, to the 2.x series introducing experimental Python 3 support in 2.15.1 and modularization of the Database Abstraction Layer into pyDAL in 2.10.1.[11] The 3.x series, starting around 2024, focused on stabilization with full support for Python 3.9+ and no backward compatibility for Python 2.7.[3] By 2020, development shifted toward maintenance mode, with the last GitHub release in March of that year, though official updates continued, culminating in version 3.0.12 in September 2025.[4] In parallel, concepts for py4web—a lighter, faster successor framework sharing pyDAL and templates—emerged around 2018, with its first public releases in 2020.[12][13]Core Features
Web-based Integrated Development Environment
web2py features a built-in web-based Integrated Development Environment (IDE) known as the admin interface, which allows developers to create, edit, upload, and manage applications entirely through a web browser without requiring any external tools or installations.[14] This interface serves as a central hub for full-cycle application development, including browsing and editing files such as models, views, and controllers via an integrated file explorer.[2] It also provides access to an error ticket viewer, where developers can inspect and resolve runtime errors and exceptions generated during application execution.[14] Unique to web2py, the IDE supports advanced editing capabilities like syntax highlighting for Python code directly in the browser, enhancing code quality and efficiency without needing desktop IDEs.[2] Additionally, it includes an interactive shell for each application, enabling real-time testing of code snippets and debugging within the web environment.[15] One-click deployment options allow instant packaging, bytecode compilation, and distribution of applications from the interface.[14] The workflow in the admin IDE begins with scaffolding new applications from built-in templates, such as the "welcome" application, which provides a starting point for rapid prototyping.[2] It integrates seamlessly with the Database Abstraction Layer (DAL) for quick editing of database models and migrations directly in the browser.[14] This browser-centric approach ensures portability, as developers can access and work on applications from any device with internet connectivity and a compatible browser.[2] Key advantages of this IDE include zero setup time, as web2py requires no configuration files or pre-installed dependencies, allowing immediate development upon unpacking the framework.[14] The interface seamlessly integrates with the built-in ticketing system for error handling, streamlining debugging in team environments.[14] Overall, these features reduce barriers to entry and promote agile development practices.[2]Database Abstraction Layer and Migrations
The web2py Database Abstraction Layer (DAL) serves as an object-relational mapper that abstracts database-specific SQL differences, allowing developers to interact with databases using Pythonic syntax without writing raw SQL. It maps Python objects to database entities such as tables, fields, records, and queries, dynamically generating SQL statements in real time based on the backend dialect. This abstraction enables seamless portability, as the same code runs unchanged across supported databases, with the DAL handling vendor-specific variations internally. Unlike external ORMs such as SQLAlchemy, the DAL is natively integrated into web2py and requires no additional dependencies for core functionality.[16][17] Schema definition in the DAL uses a declarative Python syntax, where tables are created via thedefine_table method on a DAL instance, specifying fields with the Field class. For example, a basic table might be defined as follows:
db = DAL("sqlite://storage.sqlite")
db.define_table('person', Field('name', 'string'), Field('email', 'string', unique=True))
db = DAL("sqlite://storage.sqlite")
db.define_table('person', Field('name', 'string'), Field('email', 'string', unique=True))
person with name and email fields, automatically inferring primary keys (typically an id field of type integer) unless specified otherwise. Field types include string, integer, text, reference for foreign keys, list:string for arrays, and specialized types like upload for file handling or geoPoint for spatial data. The DAL supports additional options such as default values, requires validators (e.g., IS_EMAIL for email fields), and format for custom record representations. Tables can be dropped, truncated, or imported from CSV files using built-in methods like db.table.drop() or db.table.import_from_csv_file(filename).[16][17]
The DAL natively supports a wide range of relational databases through dedicated adapters, including SQLite, PostgreSQL, MySQL, Microsoft SQL Server (MSSQL), Oracle, IBM DB2, Firebird, Informix, and Sybase. Some distributions of web2py include drivers for SQLite and MySQL out of the box, while others like PostgreSQL require external installations such as psycopg2. Connections are established via URI strings, for example, DAL("postgres://user:pass@localhost/dbname") or DAL("mssql://user:pass@host/db"), allowing multiple DAL instances for the same or different databases within an application. This broad compatibility ensures that applications can switch backends with minimal code changes, as the DAL translates operations into dialect-appropriate SQL.[16][17]
Automatic migrations in the DAL enable on-the-fly schema evolution without manual intervention, detecting differences between the defined model and the existing database structure upon application startup. By default, the migrate parameter in DAL or define_table is set to True, prompting the DAL to generate and execute ALTER statements for additions, modifications, or deletions of tables and fields while preserving data integrity. For instance, adding a new field to an existing table triggers an automatic ALTER TABLE command. Migrations are versioned and tracked in per-table files (e.g., person.table) stored in the application's databases folder, named based on an MD5 hash of the connection string to ensure consistency across environments. These files contain schema metadata, allowing the DAL to compare versions and apply changes idempotently. To avoid downtime in production, developers can use fake_migrate=True in the DAL constructor, which rebuilds metadata without altering the database, or disable migrations entirely with migrate=False for static schemas. Rollbacks for schema changes are manual, involving restoration of previous migration files or use of transaction-level db.rollback() for uncommitted data operations. The DAL integrates input sanitization during migrations and queries to prevent SQL injection, though broader security mechanisms are handled elsewhere.[16][17]
CRUD operations are facilitated through intuitive DAL methods that build on the abstracted query language, supporting complex queries with joins, ordering, and filtering. For creation, db.table.insert(**kwargs) adds records, returning the new ID; updates use db(query).update(**kwargs); deletions employ db(query).delete(); and reads leverage db(query).select(fields, **options). A representative query with join and orderby might look like:
rows = db((db.person.id == db.address.person_id) & (db.person.name == 'Alice')).select(
db.person.ALL, db.address.city,
orderby=db.person.name | db.address.city
)
rows = db((db.person.id == db.address.person_id) & (db.person.name == 'Alice')).select(
db.person.ALL, db.address.city,
orderby=db.person.name | db.address.city
)
person and address tables, ordered by name and city. For form generation and validation, the DAL provides helpers like db.table.field.validate(value), which checks against field constraints and returns errors, enabling automatic CRUD form creation via SQLFORM helpers that sanitize inputs. The query syntax uses logical operators (==, & for AND, | for OR) and supports pagination with limitby=(start, count), ensuring efficient handling of large datasets across backends. Overall, these operations maintain portability by generating backend-specific SQL, such as converting Python lists to JSON arrays in PostgreSQL or array fields in MySQL.[16][18][17]
Security and Validation Mechanisms
web2py adopts a "secure by default" philosophy, embedding protections against common web vulnerabilities directly into its core framework to minimize developer errors and proactively address issues outlined in the OWASP Top 10. This approach ensures that applications are hardened from the outset, requiring explicit opt-outs for any relaxation of security measures. For instance, the framework automatically escapes all variables rendered in HTML, XML, and JavaScript views to prevent cross-site scripting (XSS) attacks, treating output as untrusted by default. Similarly, cross-site request forgery (CSRF) is mitigated through the generation of one-time random tokens for each form submission, combined with unique identifiers for session cookies to block unauthorized actions and double submissions.[19][2] The Database Abstraction Layer (DAL) further bolsters security by parameterizing queries and escaping data, effectively eliminating SQL injection risks without manual intervention. Complementing this, web2py's validation system enforces field-level checks on forms and inputs using built-in validators such as IS_EMAIL for email formats, IS_INT_IN_RANGE for numeric bounds, and custom functions for complex rules, ensuring data integrity and rejecting malformed submissions before processing. The authentication and authorization system, powered by the Auth class, implements role-based access control (RBAC) through predefined tables like auth_user, auth_group, and auth_permission, allowing granular CRUD (create, read, update, delete) permissions tied to user roles or groups. Developers can enforce these via decorators like @auth.requires_login() or @auth.requires_permission('read', 'table'), with support for multi-factor authentication and integration with external providers such as LDAP or OAuth.[19][20][20] Session management in web2py prioritizes security by storing sessions server-side by default (configurable to file, database, or memcache), using encrypted cookies with UUIDs to prevent hijacking and tampering, particularly for non-localhost deployments. Brute-force login attempts are countered through built-in rate limiting and account lockouts in the Auth system. Additional safeguards include CAPTCHA integration, such as reCAPTCHA, for high-risk forms to deter automated abuse, and secure file upload handling that renames files with random UUIDs to avoid directory traversal exploits. Passwords are hashed using robust algorithms like HMAC+SHA-512, and HTTPS enforcement is straightforward via configuration flags. These mechanisms collectively reduce the attack surface, making web2py suitable for rapid development of secure applications.[2][20][19]Task Scheduling and Automation
web2py incorporates a ticketing system to manage runtime errors effectively, generating a unique ticket identifier for each exception encountered during application execution. This system logs comprehensive details, including stack traces, request variables, session state, and environment specifics such as the operating system and Python version, ensuring administrators have full context without exposing sensitive information to end users.[1] The tickets are stored in the application's error log and can be accessed through the web-based administrative interface for debugging, code inspection, and applying fixes directly within the integrated development environment.[1] For recurring task automation, web2py provides a portable cron scheduler that emulates Unix-like cron functionality across operating systems, including Windows, without requiring native system cron setup. Tasks are defined in the application'scron/crontab file using standard five-field syntax, such as 0 0 * * * to run daily at midnight, followed by a controller function reference like mycontroller/myfunction.[21] This scheduler executes in background threads or dedicated processes, initiated via command-line options like python web2py.py -Y for soft cron mode in WSGI environments or -C for immediate cron execution, preventing interference with web request handling.[21]
The task scheduler in web2py extends cron capabilities through the gluon.scheduler module, enabling queued background jobs via worker processes that poll a central database for tasks. Developers queue tasks programmatically using methods like scheduler.queue_task('task_function', pvars={'arg': 'value'}, timeout=60), which supports repeats, priorities, and status tracking in tables such as scheduler_task and scheduler_run.[22] This handles long-running operations asynchronously, avoiding blocking of the main web server, and stores task states in the database by default, though integrations with Redis can be implemented for distributed queuing in multi-server setups.[22] The exec_cron mechanism complements this by running Python scripts in the web2py environment as prefixed entries in the crontab, such as *script.py, ensuring consistent execution context.[21]
Shared state across applications and tasks is facilitated by the global environment in the gluon package, accessible via current.globalenv, which serves as a centralized dictionary for variables, configurations, and objects persistent beyond individual requests. This allows scheduled tasks to reference app-wide settings or inter-app data without database queries, enhancing efficiency in automation workflows.[23]
These automation features offer key benefits, including portability that eliminates OS-specific configurations and the ability to enable email notifications for error tickets through administrative setup, alerting developers to issues promptly.[1] By decoupling long-running jobs from the web interface, web2py ensures scalable, non-blocking operations suitable for production environments.[21]
Technical Specifications
Supported Environments
web2py is a cross-platform framework that supports Windows, macOS, Linux, and other Unix-like systems such as BSD. Binary distributions are provided for Windows and macOS, which include an embedded Python interpreter, while the source code version is compatible with any operating system that supports Python. There is no native support for mobile operating systems.[24][19] The framework fully supports CPython versions 3.9 and later, with earlier versions such as Python 2.7 and 3.5–3.8 deprecated or no longer maintained as of 2024. It also runs on alternative Python implementations including PyPy for performance optimization and Jython for Java integration, though these may have limitations compared to CPython. IronPython support is experimental and not officially recommended for production use.[3][25][24] web2py operates in various virtualized and cloud environments, including virtual machines like VMware and VirtualBox, as well as cloud platforms such as Amazon EC2, Google App Engine, Heroku, and PythonAnywhere. It supports containerization with Docker through community-maintained images and has low resource requirements, enabling deployment on embedded hardware like the Raspberry Pi.[26][14][27][28] For web serving, web2py includes a built-in Rocket WSGI server suitable for development and production, supporting SSL and IPv6. In production setups, it integrates with servers like Apache via mod_wsgi or mod_proxy, Nginx via uWSGI, Lighttpd and Cherokee via FastCGI, and others through CGI, SCGI, or the versatile anyserver.py script for options including Gunicorn, Tornado, and Gevent. Load balancing can be achieved by running multiple instances behind a proxy.[26][19][14]Deployment and Distribution Options
Web2py applications can be packaged for distribution using .w2p files, which are created through the administrative interface by first bytecode-compiling the application and then packing it into a single zipped archive containing the compiled models, controllers, views, and static assets.[29] This bytecode compilation process converts the Python source code into an intermediate form that obfuscates the original source, providing a level of intellectual property protection by making reverse-engineering more difficult while maintaining compatibility with the web2py runtime.[30] The resulting .w2p file allows for easy distribution of the application as a self-contained unit, though deployment still requires an existing web2py installation on the target server, which in turn depends on a compatible Python environment.[29] One-click deployment options simplify the rollout process, particularly through integrations like PythonAnywhere, where applications can be uploaded directly from the web-based IDE.[26] The IDE supports additional upload methods such as FTP and SCP for transferring applications to remote servers, and once deployed, the administrative interface enables remote management, including updates and configuration adjustments without direct server access.[26] In production environments, web2py supports horizontal scaling by deploying multiple frontend instances behind a load balancer, such as HAProxy, to distribute traffic across servers.[26] Session data can be managed via session farming, where sessions are stored in a shared database accessible by all instances, ensuring state consistency without relying on sticky sessions.[26] Static files can be offloaded to content delivery networks (CDNs) for improved performance and reduced server load, with web2py's configuration allowing seamless integration.[26] Web2py's LGPLv3 license permits the development and deployment of proprietary applications without runtime fees, as long as any modifications to the core framework are released under the same license.[31] Third-party components bundled with web2py, such as jQuery, are governed by their own permissive licenses like MIT, which do not impose additional restrictions on proprietary use.[24] For data portability during deployments or migrations, web2py provides built-in tools likedb.export_to_csv for exporting database contents to CSV files and db.import_from_csv_file for importing them, facilitating seamless transfers between environments.[32]
Development and Resources
Included Tools and Third-party Integrations
web2py includes several built-in tools designed to facilitate development and runtime management. The interactive shell, accessible via thegluon.shell module, allows developers to perform runtime inspection and execute code within a web2py application's environment, enabling tasks such as testing models or controllers interactively.[33] For performance analysis, web2py provides a built-in profiler that can be activated via command-line options like -p or --profiler, generating output files analyzable with tools such as RunSnakeRun to identify bottlenecks in application execution.[25] Additionally, the framework integrates Python's standard logging module through a configurable logger, supporting levels such as DEBUG, INFO, WARNING, ERROR, and CRITICAL, with a sample configuration file provided in the examples directory for application-specific logging.[25]
Debugging capabilities in web2py emphasize accessibility and integration. Upon encountering non-HTTP exceptions, the framework generates web-based error pages displaying detailed stack traces, variable states (including request, response, and session objects), and the content of the offending file, all tied to a unique ticket number for easy reference and logging.[30] This ticketing system stores error details for administrators while providing users with a concise report, facilitating quick diagnosis without external tools.[25] For deeper inspection, web2py supports integration with Python's pdb debugger through the gluon.debug module, allowing breakpoints via import pdb; pdb.set_trace() in code, which can be invoked during request handling for step-by-step execution.[34]
web2py bundles select third-party libraries under the MIT license or compatible terms to extend core functionality without external dependencies. It includes jQuery for client-side AJAX interactions and DOM manipulation, embedded in the default layout via web2py_ajax.html to support dynamic form handling and effects.[19] A Markdown parser is provided through gluon.contrib.markdown, enabling conversion of Markdown-formatted text to HTML for content rendering in views or wiki-like interfaces.[35] For caching and queuing, web2py supports Redis integration via the cache.redis API, allowing developers to configure Redis servers for distributed caching as an alternative to in-memory or disk-based options, with methods to retrieve statistics on key usage and performance.[26]
The framework's web-based administrative interface includes extensibility features for customization. Plugin support enables the addition of themes to alter the admin UI's appearance and layout, while components allow modular page sections that can incorporate custom helpers for tasks like form validation or data visualization.[36] The admin interface supports installation of applications from external sources, streamlining deployment workflows without leaving the browser interface. For advanced task queuing beyond the built-in scheduler, web2py's plugin architecture and API support extensions for distributed task queues, configurable with backends like Redis.

