1 CGI, SSI, ASP and PHP The Common Gateway Interface E-Commerce Prof. Sheizaf Rafaeli

2 E-Busainess, Sheizaf Rafaeli

3

4

5

6 CGI

7 How CGI Works n n Recall discussion of clients vs. servers n n The Common Gateway Interface (CGI) – –is an agreement between HTTP server implementors about how to integrate such gateway scripts and programs n CGI programs are scripts written for the http server (httpd) n The specs for CGI (1.1 and 1.2) are at

8 E-Busainess, Sheizaf Rafaeli Normal HTML vs. CGI n With Normal HTML, your browser receives HTML, and decodes it for presentation. Your browser also sends regular URL (pointer requests). n With CGI, your browser sends –PUT or GET –something else, not regular URL, –call for a program

9 E-Busainess, Sheizaf Rafaeli How CGI scripts work (2) n n Your browser decodes the first part of the URL and contacts the server. n n Your browser supplies the remainder of the URL to the server. n n The server translates the URL into a path and file name. n n The server realizes that the URL points to a program instead of a static file.

10 E-Busainess, Sheizaf Rafaeli How CGI scripts work (3) n n The server prepares the environment and launches the script. n n The script executes and reads the environment variables and STDIN. n n The script sends the proper MIME headers to STDOUT for the forthcoming content. n n The script sends the rest of its output to STDOUT and terminates.

11 E-Busainess, Sheizaf Rafaeli How CGI scripts work (4) n n Non-parsed Header (nph) scripts can bypass the server, sending stuff directly back to the browser n n The server notices that the script has finished and closes the connection to your browser. NOTE: stateless, connectionless n n Your browser displays the output from the script.

12 E-Busainess, Sheizaf Rafaeli Where CGI scripts live n CGI programs can reside anywhere, provided the location is recognized by the http server n “Anywhere” means on same machine or other, same directories or other n Best if set apart from document structure n Usually should be better protected, for fame, security, property reasons

13 E-Busainess, Sheizaf Rafaeli Programming Languages in CGI n Perl and C, C++ are the most common n Visual Basic and Java rapidly catching up n Many others used too n ASP, PHP, SSI n Tension (choice) between compiled vs. interpreted n Dimensions: –Portability, –Ease of learning, debugging –Speed, efficiency

14 E-Busainess, Sheizaf Rafaeli CGI vs. API and server specific technologies n API is emerging as one alternative to CGI n Less portable (not “common”) n “Behind” the server (httpd) n API more efficient, less compliant n Examples: Netscape ONE, Microsoft WindowsDNA, Oracle and others

15 E-Busainess, Sheizaf Rafaeli Calling a CGI script n CGI scripts can be invoked in a variety of ways. They can be called from –The tag » » –The anchor tag » » Click Here –The image tag » » –As server side includes » »

16 E-Busainess, Sheizaf Rafaeli ASP, SSI and PHP alternatives SSI (Server Side Includes): SSI lets you embed a number of special 'commands' into the HTML itself. When the server reads an SSI document, it looks for these commands and performs the necessary action. PHP is a server-side scripting language. Like ASP, PHP script is processed by the Web server. After the server plays with the PHP code, it returns plain old HTML back to the browser.

17 E-Busainess, Sheizaf Rafaeli SSI and PHP alternatives PHP HTML Embedding  SGML style:  XML style:  ASP style:  Javascript style: code Search results for " "

18 E-Busainess, Sheizaf Rafaeli The simplest (and available) Server-Side include n n The basic format for the server-side include is as follows: – – n n Possible SSI commands :   config, echo, include, exec, fsize, flastmod Depends on server configuration BEWARE!!!

19 E-Busainess, Sheizaf Rafaeli SSI example hello This file is pretty big! it is bytes or, in short bytes ò hello ssi.html This file is pretty big! it is 326 bytes or, in short 1k bytes hello again!

20 E-Busainess, Sheizaf Rafaeli Some ASP examples n Hello world (see next slide) n Greeting, Session and Time n Environment Variables (see slide) n Database Example

21 E-Busainess, Sheizaf Rafaeli Hello, ASP World! My first script was created 7/24/00

22 E-Busainess, Sheizaf Rafaeli

23 E-Busainess, Sheizaf Rafaeli The Form n n The tag is used to define the HTML to be used for user input n n Most HTML calls CGI using forms n n The tag's attributes specify – –the program's name and location either locally or as a full URL – –the type of encoding being used, – – what method is being used to transfer the data n n

24 E-Busainess, Sheizaf Rafaeli Elements in a form see n n Each tag identifies TYPE of area, has a NAME, and could have a VALUE. n n Types include: – –text, checkbox, password – –reset and submit – –Textarea and Select are special cases n For example: –

25 E-Busainess, Sheizaf Rafaeli Elements in a form (2) n Text areas are invoked using : – – n Selection menus are invoked using Cinnamon Cocoa Nutmeg Cloves Allspice Shaved Dark Chocolate Paprika

26 E-Busainess, Sheizaf Rafaeli Environment Variables available to the CGI program n Remember that this is sessionless or “connectionless” n n But: various pieces of information about: – – the browser (type, what it can view, the remote host name etc) – –the server (name and version, the port its running on, and so on) – –and the CGI program itself (the program name and where it's located). n n The server provides all of this information to the CGI program through environment variables.

27 E-Busainess, Sheizaf Rafaeli A simple environment variables program ENVIRONMENT.PL: #!/usr/local/bin/perl print "Content-type: text/html\n\n"; print " \n"; print " CGI Environment \n"; print " \n"; print " \n"; print " CGI Environment \n"; foreach $env_var (keys %ENV) { print " $env_var = $ENV{$env_var} \n"; } print " \n";

28 E-Busainess, Sheizaf Rafaeli A simple environment variables program (2) n Try running directly – n And try submitting from a form: –

29 E-Busainess, Sheizaf Rafaeli The FORM HTML Here is a post button <FORM ACTION= " METHOD=POST> And here is a Get button

30 E-Busainess, Sheizaf Rafaeli CGI and Security n Secure the machine (telnet and other access) n Secure the Web-server (daemon) n Secure the location of the cgi scripts (write and read access) n Then:   Your program should do what you want and nothing more.   Don't give client more information than it needs to know.   Don't trust the client to give you the proper information.   Minimize potential damage if break-in does occur

31 E-Busainess, Sheizaf Rafaeli CGI and Security (2) n Generally, compiled preferable over interpreted n Beware of buffer flow (pointer after-effect) n Encrypting incoming and / or outgoing messages: –SSL –SHTTP

32 E-Busainess, Sheizaf Rafaeli CGI and Security hopefully…

33 E-Busainess, Sheizaf Rafaeli CGI and client side processing

34 E-Busainess, Sheizaf Rafaeli “Packaged” CGI scripts (1) n There are thousands of scripts available n Try, for instance: – – – n CGI programming libraries are important for : –parsing –output

35 E-Busainess, Sheizaf Rafaeli “Packaged” CGI scripts (2) “ready made” n Like other providers, the UofM denies most users access to CGI directories n However, like many providers, UofM allows use of “prepackaged” applications. These include: –Finger, HtMail (forms-to- ), Imagemap, Swishgate, Counter, Survey, Guestbook (and loggate) n See

36 E-Busainess, Sheizaf Rafaeli “Hosted”, remotely hosted CGI services n n Often as simple as cutting and pasting some html into your pages. Sometimes require registration. Ranging from quizzes, "quote of the day" programs, to advanced affiliate programs and advertising systems. n See, e.g., at: – –