From Seo Wiki - Search Engine Optimization and Programming Languages
|Stable release||1.74.11 / February 3, 2010|
|Type||Web application framework|
|License||GNU GPL v2.0 (with exception)|
Web2py is an open source web application framework. Its primary goal is to support agile development of fast, scalable, secure and portable database-driven web-based applications. Web2py is written in the Python language and is programmable in Python. Since web2py was originally designed as a teaching tool with emphasis on ease of use and deployment, it does not have any project-level configuration files.Web2py was inspired by Ruby on Rails (RoR) framework and, like RoR, it focuses on rapid development, favors convention over configuration approach and follows Model-View-Controller (MVC) architectural pattern. But web2py is based on Python and provides a comprehensive web-based administrative interface, includes libraries to handle more protocols, and can run on the Google App Engine.
Thanks to Python, web2py is less verbose than Java-based frameworks, and its syntax tends to be cleaner than PHP-based frameworks. This makes applications simpler to develop, easier to read and maintain.
Web2py is a full-stack framework in that it has built-in components for all major functions, including:
- HTTP requests, HTTP responses, cookies, sessions;
- multiple protocols HTML/XML, REST, ATOM and RSS, RTF and CSV, JSON, JSON-RPC and XML-RPC, AMF-RPC (Flash/Flex), and SOAP;
- CRUD API;
- multiple authentication mechanisms and role-based access control;
- database abstraction layer (DAL) that dynamically generates SQL and runs on multiple compatible database backends;
- RAM, disk, and memcached-based caching for scalability;
- internationalization support;
- jQuery for Ajax and UI effects;
- automatic logging of errors with context.
Web2py encourages sound software engineering practices such as
- the Model-View-Controller (MVC) pattern;
- self-submission of web forms;
- server-side sessions;
- safe handling of uploaded files.
Originally designed as a teaching tool at DePaul University, web2py has a very shallow learning curve. It requires little or no installation or configuration, and provides a fully web-based development environment.
Web2py uses the WSGI protocol, the Python-oriented protocol for communication between web server and web applications. It also provides handlers for CGI and the FastCGI protocols, and it includes the multi-threaded, SSL-enabled CherryPy wsgiserver.
Web2py has frequent releases and is easy to update. Despite frequent releases, web2py's developers have not broken backward compatibility since v1.0 in 2007, and have pledged not to break it in the future.
Web-based integrated development environment (IDE)
All development, debugging, testing, maintenance and remote database administration can (optionally) be performed without third party tools, via a web interface, itself a web2py application. Internationalization (adding languages and writing translations) can also be performed from this IDE. Each application has an automatically generated database administrative interface, similar to Django. The web IDE also includes web-based testing and a web-based shell.
- Wing IDE allows graphical debugging of web2py applications as you interact with it from your web browser, you can inspect and modify variables, make function calls etc.
- Eclipse/PyDev — Eclipse with the Aptana PyDev plugin — supports web2py as well.
- The extensible pdb debugger is a module of Python's standard library.
- With the platform-independent open-source Winpdb debugger, you can perform remote debugging over TCP/IP, through encrypted connection.
def hello(): return 'Hello World'
Web2py includes a fast, pure Python-based template language, with no indentation requirements and a server-side Document Object Model (DOM). The template system works without web2py. Joomla 1.x templates can be converted to web2py layouts.
A controller without a view automatically uses a generic view that render the variables returned by the controller, enabling the development of an application's business logic before writing HTML. The "Hello World" example using a default template:
def hello(): return dict(greeting='Hello World')
- Cross-site scripting (XSS): web2py, by default, escapes all variables rendered in the view, thus preventing XSS.
- Injection Flaws: web2py includes a database abstraction layer that makes SQL injections impossible.
- Malicious File Execution: web2py allows only exposed controllers to be executed and thus prohibits malicious file execution.
- Insecure Direct Object Reference: web2py does not exposes any internal object; moreover web2py validates all URLs thus preventing directory traversal attacks.
- Cross-site request forgery (CSRF): web2py only uses session cookies and prevents double submission of forms.
- Information Leakage and Improper Error Handling: web2py provides a built-in ticketing system.
- Broken Authentication and Session Management: web2py has a built-in mechanism for session management, using a cookie to store the session id.
- Insecure Cryptographic Storage: web2py uses a SHA512 HMAC algorithms to hash passwords. MD5 is also supported.
- Insecure Communications: web2py works with Apache and mod_ssl to provide strong encryption of communications.
- Failure to Restrict URL Access: web2py maps URLs into function calls, and provides a mechanism for declaring which functions are public and which require authentication/authorization.
Each web2py application comes with a ticketing system:
- If an error occurs, it is logged and a ticket is issued to the user. That allows error tracking.
- Errors and source code are accessible only to the administrator, who can search and retrieve errors by date or client-IP. No error can result in code being exposed to the users.
Cron is a mechanism for creating and running recurrent tasks in background. It looks for an application-specific crontab file which is in standard crontab format. Three modes of operation are available:
- Soft cron: cron routines are checked after web page content has been served, does not guarantee execution precision. For unprivileged Apache CGI/WSGI installs.
- Hard cron: a cron thread gets started on web2py startup. For Windows and CherryPy/standalone web2py installs.
- System cron: cron functions get force-called from the command line, usually from the system crontab. For Unix/Linux systems and places where the cron triggers need to be executed even if web2py is not running at the moment. Also good for CGI/WSGI installs if you have access to the system crontab.
Source code protection
Web2py can compile web applications and you can distribute them in bytecode compiled form, without source code. This helps but does not guarantee source code protection due to the existence of disassemblers and decompilers for Python bytecode (*.pyc and *.pyo files):
- Dis module of the Python standard library allows you to disassemble, but not decompile Python bytecode.
- Open source Decompyle Python disassembler and decompiler converts Python bytecode back into equivalent Python source. It accepts bytecode from any Python version between 1.5 and 2.3 inclusive. It doesn't support versions above 2.3 and hard to use.
- Commercial decompyle service origins at Decompyle. It decompiles Python versions 1.5 up to 2.6, with some minor limitations.
- Open source UnPyc is a tool for disassembling, analyzing and decompiling Python bytecodes, with various success. UnPyc supports Python v2.5 and v2.6.
- more efficient code;
- adequate safety of intellectual property;
- reduced security exposure of private information in the code, such as usernames and passwords.
Operating systems, Python versions & implementations, virtual machines, hardwares
Web2py is targeted at Python 2.5, but is compatible with 2.4 and 2.6.
- no csv module (so no database I/O);
- no third party database drivers (not even SQLite, so no databases at all);
- no built-in web server (unless you cripple it by removing signals and logging).
A VMWare appliance is planned.
Web2py can service requests via HTTP and HTTPS with its built-in CherryPy server, with Apache, Lighttpd, Cherokee, Nginx and almost any other web server through CGI, FastCGI, WSGI, mod_proxy, and/or mod_python.
IDEs and debuggers
Web2py has a built-in web-based IDE, and is generally compatible with third-party Python development tools.
The database abstraction layer (DAL) of web2py dynamically and transparently generates SQL queries and runs on multiple compatible database backend without the need for database-specific SQL commands (though SQL commands can be issued explicitly).
SQLite is included in Python and is the default web2py database. A connection string change allows connection to Firebird, IBM DB2, Informix, Ingres, Microsoft SQL Server, MySQL, Oracle, PostgreSQL, and Google App Engine (GAE) with some caveats. Specialities:
- Multiple databases connections.
- Automatic table creates and alters.
- Automatic transactions.
- Distributed transactions:
- GAE is not a relational store, but web2py emulates certain operations.
Web2py implements a DAL, not an ORM. An ORM maps database tables into classes and records into instances of those classes. The DAL instead maps database tables into instances of a class and records into instances of another class. It has very similar syntax to an ORM but it is faster, and can map almost any SQL expressions into DAL expressions. The DAL can be used without web2py.
Automatic database migrations
Web2py supports database migrations—change the definition of a table and web2py ALTERs the table accordingly. Migrations are automatic, but can be disabled for any table. Migrations and migration attempts are logged, documenting the changes.
- SQLite does not understand migrations well. In particular it can't alter table and change a column type, but rather simply stores new values according to the new type.
- GAE has no concept of alter-table, so migrations are limited.
Ready to use applications with source code
You can find many free and ready to use web2py plugins and applications with full source code, ready to customize, with various licenses.
Mostly on this list at its homepage, some of them:
- Ajax SpreadSheet: an embeddable spreadsheet.
- Chat: Ajax web chat supports multiple users and rooms.
- Cookbook: a simple appliance that allows users to post cookbook recipes. Plus a step-by-step tutorial about creating it.
- GrooverWiki: a wiki.
- KPAX CMS: a full CMS. Does web pages, wikis, blogs, chats, news, groups, permissions, RSS feeds.
- Podcasts: this program let you receive, watch and listen to podcasts from various sources.
- Reddish: a Reddit clone for the Google App Engine.
- QrOne CSS Designer: application to build CSS layouts.
- DamianLogAnalizer: log analyzer application that does charting.
- IsUp: you list a bunch of URLs and it probes them every 30 seconds. It maintains a database of when the URLs were down.
Three of them elsewhere:
- PyForum, a full-fledged message board system.
- T2, a web2py plugin that implements web development patterns — registration, login, logout, groups, access, attachments, comments, previews, etc. —, with extensive documentation.
- T3, a wiki application that runs everywhere, including on Google App Engine. Super-powered: it allows admin to define database tables (using DAL syntax) and to embed Python code into the source code of wiki pages.
A quick reference to the high-level web2py functionality that was added in T2 and T3: T2/T3 cheat sheet.
Web sites and applications using web2py
Web2py code is released under GNU GPL v2.0 with commercial exception. Various third-party packages distributed with web2py have their own licenses, generally MIT or BSD-type licenses. Applications built with web2py are not covered by the GPL license.
Web2py is copyrighted by Massimo DiPierro. The web2py trademark is owned by Massimo DiPierro.
- Online documentation on its homepage, with cookbook, videos, interactive examples, interactive API reference, epydocs (complete library reference), FAQ, cheat sheet, online tools etc.
- Web2py wiki — it's actually built using web2py.
- Web2py slides.
- web2py Enterprise Web Framework Tutorial.
- web2py "Shootout" video tutorial.
- web2py on the Google appengine.
- More video tutorials on Vimeo.
- Web programming with web2py; Python Magazine; Marco Tabini & Associates, Inc.; June 2008
- The official web2py manual, written by Massimo DiPierro:
Community support is available through the web2py knowledge base, the web2py mailing list at Google Groups, and the #web2py channel on IRC. As of 2009-10-02, commercial web2py support is provided by fifteen companies worldwide.
Development source code
The web2py development source code is available from two repositories:
Third-party software included in web2py
- Python-based components:
- a fast, HTTP/1.1-compliant, multi-threaded, SSL-enabled and streaming-capable WSGI server from CherryPy;
- fcgi.py: a FastCGI/WSGI gateway;
- simplejson: a simple, fast, complete, correct and extensible JSON encoder and decoder;
- markdown2: a Markdown processor, so you can write using this easy-to-read, easy-to-write plain text format, then on the fly convert it to structurally valid XHTML (or HTML);
- PyRTF: an RTF document generator;
- a syntax highlighter;
- PyRSS2Gen: an RSS generator;
- feedparser: to parse RSS and Atom feeds.
- C-based components:
History and naming
The source code for the first public version of web2py was released under GNU GPL v2.0 on 2007-09-27 by Massimo DiPierro as the Enterprise Web Framework (EWF). The name was changed twice due to name conflicts:
- EWF v1.7 was followed by Gluon v1.0.
- Gluon v1.15 was followed by web2py v1.16.
Web.py has a similar name, but they are unrelated.
- ↑ Web2py speaks multiple protocols since v1.63
- ↑ Using SOAP with web2py
- ↑ Writing Smart Web-based Forms
- ↑ Web2py online IDE with It's All Text! Firefox addon and Ulipad (open source Python IDE)]
- ↑ How to debug Web2py applications?
- ↑ Wing IDE supports debugging for web2py
- ↑ Eclipse/PyDev supports debugging for web2py
- ↑ Using web2py on Eclipse
- ↑ With Winpdb you can do remote debugging over TCP/IP
- ↑ Encrypted communication in Winpdb
- ↑ Simplest web page with web2py: "Hello World" example
- ↑ How to use web2py templates without web2py
- ↑ Using Joomla templates with web2py
- ↑ Top 10 security issues according to OWASP in 2007
- ↑ Top 10 security issues according to OWASP and what web2py does about them
- ↑ Disassembler for Python bytecode
- ↑ Extending Python with C or C++
- ↑ Cython simplifies the writing of C extension modules for Python.
- ↑ Pyrex developed to aid in creating Python modules, its syntax is very close to Python.
- ↑ How to run web2py with Python 2.4
- ↑ Web2py runs fully on Java and J2EE using Jython
- ↑ Web2py runs with IronPython on .NET, with limitations
- ↑ Web2py VMWare appliance coming soon
- ↑ MySQL with web2py Windows binary on a USB thumb-drive
- ↑ How to run the built-in SSL server
- ↑ Web2py with Apache and mod_ssl
- ↑ Web2py with Lighttpd and FastCGI
- ↑ Web2py with Cherokee
- ↑ Apache Module mod_proxy
- ↑ Web2py with mod_proxy
- ↑ Web2py with mod_proxy and mod_proxy_html
- ↑ Distributed transactions with PostgreSQL
- ↑ Distributed transactions with PostgreSQL — further details
- ↑ ORM Benchmark
- ↑ How to use web2py DAL without web2py
- ↑ web2py License Agreement
- ↑ IRC #web2py channel
- ↑ Commercial support for web2py
- ↑ List of main contributors to web2py
- ↑ CherryPy v3 WSGI server benchmark results
- ↑ How fast is CherryPy?