Web2py Python Framework Guide — Build Database-Driven Web Applications

Web2py is a full-stack Python web framework designed for ease of use and rapid development, featuring a unique web-based IDE and zero-configuration approach.

What You’ll Learn

• How Web2py’s zero-configuration philosophy speeds up development
• How to use the Database Abstraction Layer (DAL) to work with databases
• How to build controllers, views, and models in Web2py
• How Web2py’s built-in security features protect your application
• How to deploy a Web2py application

Why Web2py Matters

Web2py’s zero-configuration design means you can start building database-driven web applications immediately — no configuration files, no complex setup. Its built-in Database Abstraction Layer (DAL) lets you write the same code for SQLite, PostgreSQL, and MySQL. The web-based IDE allows rapid prototyping directly in the browser. Web2py’s focus on security (CSRF protection, SQL injection prevention, XSS filtering) makes it a solid choice for internal tools and rapid application development at DodaTech.

    flowchart LR
    A["Python Basics"] --> B["Web2py"]
    B --> C["Controllers"]
    B --> D["Models"]
    B --> E["Views"]
    C --> F["Web App"]
    D --> F
    E --> F
    style A fill:#2563eb,stroke:#2563eb,color:#fff
    style B fill:#2563eb,stroke:#2563eb,color:#fff
    style C fill:#dbeafe,stroke:#2563eb,color:#1e40af
    style D fill:#dbeafe,stroke:#2563eb,color:#1e40af
    style E fill:#dbeafe,stroke:#2563eb,color:#1e40af
    style F fill:#2563eb,stroke:#2563eb,color:#fff
  

Core Architecture

Web2py follows the MVC (Model-View-Controller) pattern:

• Models (models/) — define database tables and relationships
• Controllers (controllers/) — handle HTTP requests and business logic
• Views (views/) — HTML templates that display data

Controller Example

# controllers/default.py
def index():
    return dict(message="Hello Web2py!")

def list_products():
    products = db().select(db.product.ALL)
    return dict(products=products)

Let’s trace what happens when a user visits /default/index:

1. Web2py routes the request to controllers/default.py
2. It calls the index() function
3. The function returns a dictionary {"message": "Hello Web2py!"}
4. Web2py looks for the view views/default/index.html
5. The view renders the HTML using the dictionary values
6. Web2py sends the rendered HTML to the browser

Model Example (Database Definition)

# models/db.py
db.define_table('product',
    Field('name'),
    Field('price', 'double'),
    Field('description', 'text')
)

This single call creates the database table (if it doesn’t exist), defines columns with appropriate SQL types, and creates an ORM interface to query it.

View Template

<!-- views/default/index.html -->
{{extend 'layout.html'}}
<h1>{{=message}}</h1>

<!-- views/default/list_products.html -->
{{extend 'layout.html'}}
<h1>Products</h1>
<ul>
{{for product in products:}}
    <li>{{=product.name}} — ${{=product.price}}</li>
{{pass}}
</ul>

Database Abstraction Layer (DAL)

The DAL is one of Web2py’s strongest features. It abstracts away database differences:

# models/db.py
# Works the same with SQLite, PostgreSQL, MySQL, Oracle
db = DAL("sqlite://storage.db")
# db = DAL("postgres://user:pass@localhost/mydb")
# db = DAL("mysql://user:pass@localhost/mydb")

db.define_table('product',
    Field('name', requires=IS_NOT_EMPTY()),
    Field('price', 'double', requires=IS_FLOAT_IN_RANGE(0, 100000)),
    Field('description', 'text'),
    Field('category', requires=IS_IN_SET(['Electronics', 'Books', 'Food'])),
    Field('created_on', 'datetime', default=request.now),
)

# Query examples
products = db(db.product.price < 50).select()           # Filter by price
products = db(db.product.name.contains('laptop')).select()  # Search by name
product = db.product(id=1)                               # Get by ID
count = db(db.product.category == 'Books').count()       # Count records

Built-in Security

Web2py has security built in at every level:

# CSRF protection — automatic, no configuration needed
# SQL injection prevention — DAL sanitizes all queries automatically
# XSS filtering — template engine escapes output by default

# Authentication
from gluon.tools import Auth
auth = Auth(db)
auth.define_tables()

# Protect a controller with @auth.requires_login()
@auth.requires_login()
def profile():
    return dict(user=auth.user)

# Role-based access
@auth.requires_membership('admin')
def admin_panel():
    return dict()

Forms and Validation

Web2py can generate forms automatically from database tables:

def add_product():
    form = SQLFORM(db.product).process()
    if form.accepted:
        response.flash = 'Product added!'
        redirect(URL('list_products'))
    elif form.errors:
        response.flash = 'Form has errors'
    return dict(form=form)

# In the view:
# {{=form}}

Key Features

Common Mistakes

1. Forgetting to Call .process() on Forms

form = SQLFORM(db.product)         # No validation!
form = SQLFORM(db.product).process()  # Validates and processes

2. Not Using auth.requires_login()

Without this decorator, any visitor can access your protected pages.

3. Confusing DAL Query Syntax

# Wrong — forgetting .select()
products = db.product.price < 50

# Right
products = db(db.product.price < 50).select()

4. Hardcoding Database Paths

Use request.folder to reference the application directory instead of hardcoding paths.

Practice Questions

1. What does SQLFORM(db.product).process() do?

It generates an HTML form for the product table, validates submitted data against field requirements, and inserts the record into the database if valid.

2. How does Web2py prevent SQL injection?

The DAL automatically escapes all query parameters. You never write raw SQL, so injection is prevented at the framework level.

3. What’s the ticketing system?

When an error occurs in production, Web2py shows the user a ticket ID instead of a stack trace. The developer can look up the full error details by that ticket ID.

Challenge: Build a simple blog in Web2py with a post table (title, body, created_on), a controller that lists all posts and shows individual posts, and views for each.

FAQ

Try It Yourself

Create a new Web2py application and add this controller:

# controllers/default.py
def index():
    return dict(message="Hello Web2py!")

def list_products():
    products = db().select(db.product.ALL)
    return dict(products=products)

And corresponding views to render the data. Run the Web2py admin panel to manage your application through the browser.

What’s Next

Now explore other Python web frameworks.

What’s Next

Congratulations on completing this Web2Py tutorial! Here’s where to go from here:

• Practice daily — Consistency is more important than long study sessions
• Build a project — Apply what you learned by building something real
• Explore related topics — Check out other tutorials in the same category
• Join the community — Discuss with other learners and share your progress

Remember: every expert was once a beginner. Keep coding!