Some questions you may have regarding WEB4J are answered below.
Is it free? Yes.
Is it open source? Yes. It's released under the BSD License.
Is it full stack? Does it help me build all parts of my app? Yes.
I don't want to use its data layer. Can I implement persistence using use my preferred tool instead? Yes.
I like the WEB4J data layer, but I don't want to use the other parts. Can I use just its data layer? Yes, but it's not very clean.
What database can I use it with? Any relational database with a JDBC driver.
Does it use convention over configuration in any way? Yes.
Does it have a non-trivial example application? Yes.
What tools do I need to know? HTML with JSP/JSTL, Java, and SQL. That's it.
Is it Ajax-y? No.
Is it REST-y? No.
Are there any books on WEB4J? No. Web4j is a small, minimalist tool, a fraction of the size of many of its competitors. Buying a book would likely be an unnecessary expense, since it's so easy to learn and use on its own.
What will my markup usually look like, especially an HTML form? link.
How exactly are forms populated with data? link.
What does a typical Action look like? link.
Any constraints on Action classes? Most will extend an abstract base class, and take a single RequestParser object in the constructor. Must declare all valid RequestParameter objects.
What does a typical Model Object look like? link.
Any constraints on Model Objects? Constructor throws ModelCtorException. A naming convention relates getXXX methods to names of form controls.
Are Model Objects immutables or Java Beans? Immutables preferred, JavaBeans also easy.
Does validation live in the Model Object? Yes.
What does validation look like? For immutables, recommend private validateState() method in Model Object.
What does a typical DAO look like? link.
Any constraints on a DAO class? Methods throw DAOException (or related).
Can any of my classes be package-private? DAOs can often be package-private. Model Objects can occasionally be package-private (for example, encapsulate search criteria). Actions always public.
Who creates the SQL? Developer creates the SQL, not the framework. SQL is placed in plain text .sql files beside the classes that use it.
Is it more about request/response, or about events and components? Request/response.
Does it care a lot about helping me create secure apps? Yes.
Can it protect me from XSS attacks? Yes, if you follow recommendations.
Can it protect me from CSRF attacks? Yes, if you follow recommendations.
Will it protect me from SQL Injection attacks? Yes, but sometimes you need to create SQL dynamically in code. In those cases, you need to make sure you parameterize data entered by the end user.
Can it help protect me from Insecure Direct Object References? Yes.
Does it provide fancy UI widgets? No.
Does it use object-relational mapping (ORM)? No.
How is translation handled? link.
Can translations be stored in the database? Yes.
Is it test-friendly? Yes. Various test double classes are provided. Their source code may be modified if needed.
How is a URL mapped to an Action? link.
What are the tool's main drawbacks? link.
Can all items related to a single feature (roughly, a screen) be placed in a single directory (code, JSPs and database items)? Yes. Recommended, but not required.
Can templating tools other than JSP can be used? No.
How does it template pages? The example app simply uses existing tools: <jsp:include> and .tag files (perfectly adequate for many uses).
What properties files are used? None.
What XML files are used? Only web.xml.
What fraction of my time will be spent in XML-land, approximately? Almost none.
Does it use annotations? No.
Does it force me to perform casts? No.
Are any files likely to be a source of developer contention? No.
Does it allow me to define custom converter classes for translating text into 'value objects'? No.
Does it have any help for code tables/pick lists? Some. Example application illustrates this.
Does it know about Web Services? No.
Does it know about Messaging? No.
Can I implement translation using one JSP per language, if necessary? Yes.
How do I upload files? Use Servlet 3.0, if available. If not, you need a third party tool, such as Apache FileUpload.
Can I serve binary files? Yes.
Can I serve JSON or XML structured data? Yes.