1 CGI The Common Gateway Interface E-Commerce Prof. Sheizaf Rafaeli

2 E-Commerce, Sheizaf Rafaeli CGI

3 How CGI Works n n Recall discussion of clients vs. servers n n The Common Gateway Interface (CGI) – –is an agreement between HTTP server implementors about how to integrate such gateway scripts and programs n CGI programs are scripts written for the http server (httpd) n The specs for CGI (1.1 and 1.2) are at

4 E-Commerce, Sheizaf Rafaeli Normal HTML vs. CGI n With Normal HTML, your browser receives HTML, and decodes it for presentation. Your browser also sends regular URL (pointer requests). n With CGI, your browser sends –PUT or GET –something else, not regular URL, –call for a program

5 E-Commerce, Sheizaf Rafaeli How CGI scripts work (2) n n Your browser decodes the first part of the URL and contacts the server. n n Your browser supplies the remainder of the URL to the server. n n The server translates the URL into a path and file name. n n The server realizes that the URL points to a program instead of a static file.

6 E-Commerce, Sheizaf Rafaeli How CGI scripts work (3) n n The server prepares the environment and launches the script. n n The script executes and reads the environment variables and STDIN. n n The script sends the proper MIME headers to STDOUT for the forthcoming content. n n The script sends the rest of its output to STDOUT and terminates.

7 E-Commerce, Sheizaf Rafaeli How CGI scripts work (4) n n Non-parsed Header (nph) scripts can bypass the server, sending stuff directly back to the browser n n The server notices that the script has finished and closes the connection to your browser. NOTE: stateless, connectionless n n Your browser displays the output from the script.

8 E-Commerce, Sheizaf Rafaeli Where CGI scripts live n CGI programs can reside anywhere, provided the location is recognized by the http server n “Anywhere” means on same machine or other, same directories or other n Best if set apart from document structure n Usually should be better protected, for fame, security, property reasons

9 E-Commerce, Sheizaf Rafaeli Programming Languages in CGI n Perl and C, C++ are the most common n Visual Basic and Java rapidly catching up n Many others used too n Tension (choice) between compiled vs. interpreted n Dimensions: –Portability, –Ease of learning, debugging –Speed, efficiency

10 E-Commerce, Sheizaf Rafaeli CGI vs. API and server specific technologies n API is emerging as one alternative to CGI n Less portable (not “common”) n “Behind” the server (httpd) n API more efficient, less compliant n Examples: Netscape ONE, Microsoft WindowsDNA, Oracle and others

11 E-Commerce, Sheizaf Rafaeli Calling a CGI script n CGI scripts can be invoked in a variety of ways. They can be called from –The tag » » –The anchor tag » » Click Here –The image tag » » –As server side includes » »

12 E-Commerce, Sheizaf Rafaeli The simplest (and available) Server-Side include n n The basic format for the server-side include is as follows: – – n n Possible SSI commands :   config, echo, include, exec, fsize, flastmod Depends on server configuration BEWARE!!!

13 E-Commerce, Sheizaf Rafaeli The Form n n The tag is used to define the HTML to be used for user input n n Most HTML calls CGI using forms n n The tag's attributes specify – –the program's name and location either locally or as a full URL – –the type of encoding being used, – – what method is being used to transfer the data n n

14 E-Commerce, Sheizaf Rafaeli Elements in a form see n n Each tag identifies TYPE of area, has a NAME, and could have a VALUE. n n Types include: – –text, checkbox, password – –reset and submit – –Textarea and Select are special cases n For example: –

15 E-Commerce, Sheizaf Rafaeli Elements in a form (2) n Text areas are invoked using : – – n Selection menus are invoked using Cinnammon Cocoa Nutmeg Cloves Allspice Shaved Dark Chocolate Paprika

16 E-Commerce, Sheizaf Rafaeli Environment Variables available to the CGI program n Remember that this is sessionless or “connectionless” n n But: various pieces of information about: – – the browser (type, what it can view, the remote host name etc) – –the server (name and version, the port its running on, and so on) – –and the CGI program itself (the program name and where it's located). n n The server provides all of this information to the CGI program through environment variables.

17 E-Commerce, Sheizaf Rafaeli A simple environment variables program ENVIRONMENT.PL: #!/usr/local/bin/perl print "Content-type: text/html\n\n"; print " \n"; print " CGI Environment \n"; print " \n"; print " \n"; print " CGI Environment \n"; foreach $env_var (keys %ENV) { print " $env_var = $ENV{$env_var} \n"; } print " \n";

18 E-Commerce, Sheizaf Rafaeli A simple environment variables program (2) n Try running directly – n And try submitting from a form: –

19 E-Commerce, Sheizaf Rafaeli The FORM HTML Here is a post button <FORM ACTION= " METHOD=POST> And here is a Get button

20 E-Commerce, Sheizaf Rafaeli CGI and Security n Secure the machine (telnet and other access) n Secure the Web-server (daemon) n Secure the location of the cgi scripts (write and read access) n Then:   Your program should do what you want and nothing more.   Don't give client more information than it needs to know.   Don't trust the client to give you the proper information.   Minimize potential damage if break-in does occur

21 E-Commerce, Sheizaf Rafaeli CGI and Security (2) n Generally, compiled preferable over interpreted n Beware of buffer flow (pointer after-effect) n Encrypting incoming and / or outgoing messages: –SSL –SHTTP

22 E-Commerce, Sheizaf Rafaeli CGI and Security hopefully…

23 E-Commerce, Sheizaf Rafaeli “Packaged” CGI scripts (1) n There are thousands of scripts available n Try, for instance: – – n CGI programming libraries are important for : –parsing –output

24 E-Commerce, Sheizaf Rafaeli “Packaged” CGI scripts (2) “ready made” n Like other providers, the UofM denies most users access to CGI directories n However, like many providers, UofM allows use of “prepackaged” applications. These include: –Finger, HtMail (forms-to- ), Imagemap, Swishgate, Counter, Survey, Guestbook (and loggate) n See