Dangerous

import cgi

from google.appengine.api import users
from google.appengine.ext import webapp
from google.appengine.ext.webapp.util import run_wsgi_app
import sys
import StringIO

class MainPage(webapp.RequestHandler):
    def get(self):
        self.response.out.write("""
          <html>
            <body>
              <form action="/execute" method="post">
                <div><textarea name="code" rows="3" cols="60"></textarea></div>
                <div><input type="submit" value="Write some arbitrary python!!!"></div>
              </form>
            </body>
          </html>""")


class Executor(webapp.RequestHandler):
    def post(self):
        gae_stdout = sys.stdout
        output = StringIO.StringIO()
        self.response.out.write('<html><body>You wrote:<pre>')
        sys.stdout = output
        code = compile(self.request.get('code'),'<string>','exec')
        ns = {} #one should clone globals and remove dangerous items
        exec code in ns
        self.response.out.write(output.getvalue())
        self.response.out.write('</pre></body></html>')
        sys.stdout = gae_stdout

application = webapp.WSGIApplication(
                                     [('/', MainPage),
                                      ('/execute', Executor)],
                                     debug=True)
def main():
    run_wsgi_app(application)

if __name__ == "__main__":
    main()