1. Comp2513 Forms and CGI Server Applications Daniel L. Silver, Ph.D.

2. 2002Daniel L. Silver2 Objectives To discuss HTML Forms and CGI Scripts To discuss HTML Forms and CGI Scripts To introduce the concept of server applications and discuss their use as a part of an E-Commerce infrastructure To introduce the concept of server applications and discuss their use as a part of an E-Commerce infrastructure References: Ch. 2 Sharma (p.38-41), DDEA p.115-124 References: Ch. 2 Sharma (p.38-41), DDEA p.115-124

3. 2002Daniel L. Silver3 Outline HTML Forms HTML Forms HTTP GET and POST Methods HTTP GET and POST Methods CGI ServerApplications CGI ServerApplications Drawbacks of CGI Drawbacks of CGI Forms and Javascript Forms and Javascript Cookies Cookies

4. 2002Daniel L. Silver4 HTML Forms Forms are part of an HTML document Forms are part of an HTML document.. input elements like text fields, radio buttons, etc.... one or more submit buttons.. </FORM> Simple form example: greet_shell2.html Simple form example: greet_shell2.htmlgreet_shell2.html User enters data, selects options User enters data, selects options User sends request by clicking on a submit button User sends request by clicking on a submit button Data is processed by Javascript or sent back to client for processing using a CGI script Data is processed by Javascript or sent back to client for processing using a CGI script The results returned to the browser as HTML The results returned to the browser as HTML

5. 2002Daniel L. Silver5 CGI – Common Gateway Interface CGI is a standard for HTTP client to server application communications that defines: CGI is a standard for HTTP client to server application communications that defines: –How a client can request to run an application on a server and use specified input data –How the data is passed to the server application –How the server application can pass the response back to the client CGI is NOT a programming langauge CGI is NOT a programming langauge

6. 2002Daniel L. Silver6 Forms and CGI: Examples A barebones CGI request for execution of a sever application : Hello_time.html A barebones CGI request for execution of a sever application : Hello_time.html Hello_time.html Passing parameters to a program on a server via the CGI protocol: greet_shell.html Passing parameters to a program on a server via the CGI protocol: greet_shell.htmlgreet_shell.html Combining forms and CGI: greet_shell2.html Combining forms and CGI: greet_shell2.html greet_shell2.html

7. 2002Daniel L. Silver7 How is User Data Passed to the Server? Either GET or POST HTTP method is used Either GET or POST HTTP method is used See the forms tutorial See the forms tutorialforms tutorialforms tutorial The default and the one used in the previous example is GET The default and the one used in the previous example is GET Recall … the HTTP Request Header Recall … the HTTP Request Header GET /demo/Hello.html HTTP 1.0 Accept: text/plain Accept: text/html User-Agent: Mozilla/2.0 <CR/LF>

8. 2002Daniel L. Silver8 How is User Data Passed to the Server? With the GET method, the browser appends a “?” to the URL followed by the user entered FORM data. So you see: With the GET method, the browser appends a “?” to the URL followed by the user entered FORM data. So you see:http://eagle.acadiau.ca/demo/cgi-bin/greet_shell.cgi?name=Danny The server reads the data following the “?” and makes it available in the form of environment variable, QUERY_STRING The server reads the data following the “?” and makes it available in the form of environment variable, QUERY_STRING The CGI application on the server must read and parse this environment variable The CGI application on the server must read and parse this environment variable

9. 2002Daniel L. Silver9 How is User Data Passed to the Server? With the POST method, the browser creates a message containing the user entered FORM data. With the POST method, the browser creates a message containing the user entered FORM data. The message is sent to the server and forwards it on to the requested application in the form of an “input stream” The message is sent to the server and forwards it on to the requested application in the form of an “input stream” The CGI application on the server must read and parse the input stream The CGI application on the server must read and parse the input stream An example: RequestParamExample.html, RequestParamExample.java An example: RequestParamExample.html, RequestParamExample.javaRequestParamExample.html RequestParamExample.javaRequestParamExample.html RequestParamExample.java

10. 2002Daniel L. Silver10 POST versus Get Methods Advisable to use POST Advisable to use POST GET is limited to 1024 characters (restricted by the environment variable size limits) GET is limited to 1024 characters (restricted by the environment variable size limits) POST provides a first order level of security POST provides a first order level of security –Why?

11. 2002Daniel L. Silver11 Other Data Available at Server The server application that reads the FORM data can also access other information provided by the CGI standard: The server application that reads the FORM data can also access other information provided by the CGI standard: –REMOTE_ADDR – the IP address of the client –REMOTE_HOST – fully qualified URL of host –CONTENT_LENGTH – length of FORM data –Checkout “Request Info” and “Request Headers” : http://eagle.acadiau.ca:8080/examples/servlets/

12. 2002Daniel L. Silver12 CGI Server Applications A CGI Script can be any program that can execute on the server A CGI Script can be any program that can execute on the server –Shell script, Perl script, C, C++ –Perl Example: perl_greeting.html perl_greeting.html –Perl code: perl_greeting.cgi perl_greeting.cgi »NOTE: to see Perl code open in source view

13. 2002Daniel L. Silver13 Drawbacks of CGI Each time a CGI application is requested by an HTML page the server is requested to start a separate process Each time a CGI application is requested by an HTML page the server is requested to start a separate process This is true even if it is a Java program This is true even if it is a Java program doThis.cgi :#!/bin/sh java doThis.class A new JVM is started each time A new JVM is started each time –Takes time to set up and take down –Uses memory resources on the server

14. 2002Daniel L. Silver14 Forms and Javascript Javascript was introduced by NetScape Javascript was introduced by NetScape A client-side language A client-side language Provides program logic embedded in HTML for generation of dynamic webpages and minor computation Provides program logic embedded in HTML for generation of dynamic webpages and minor computation Manipulation of objects in HTML page including the creation and movement of browser windows Manipulation of objects in HTML page including the creation and movement of browser windowsmovement of browser windowsmovement of browser windows Most importantly allows validation of entered FORM data: calculator, greet_javascript Most importantly allows validation of entered FORM data: calculator, greet_javascriptcalculatorgreet_javascriptcalculatorgreet_javascript

15. 2002Daniel L. Silver15 Cookies Recall the problem of web sessions being connectionless Recall the problem of web sessions being connectionless TCP/IP is connection oriented but each HTTP request/response uses one such connection and then terminates TCP/IP is connection oriented but each HTTP request/response uses one such connection and then terminates State is not maintained from page to page State is not maintained from page to page Each item you order is a separate request Each item you order is a separate request So how does a E-Comm site know how to accumulate orders for you? So how does a E-Comm site know how to accumulate orders for you?

16. 2002Daniel L. Silver16 What’s a Cookie A Cookie is a small piece of data placed on a client system that is used by the server to identify the client A Cookie is a small piece of data placed on a client system that is used by the server to identify the client –Client, about to make a request to a server, checks to see if it has an associated cookie »If cookie, then send it with the request –Server checks for cookie in request »If cookie, then pass it to any applications called –Server may create a new cookie and return it with the response to the client –Client receives response and checks for new cookie »If cookie, then it saves it for this server URL

17. 2002Daniel L. Silver17 Cookies are not programs … Contain 4K of text or less Contain 4K of text or less There limits stored by a browser (default: 20 per site, 300 in total, oldest are deleted) There limits stored by a browser (default: 20 per site, 300 in total, oldest are deleted) Only the originating domain can ever use the contents of their cookies Only the originating domain can ever use the contents of their cookies Written with or without an expiry date Written with or without an expiry date Turn on your browser’s cookie warnings to observe how frequent they are used Turn on your browser’s cookie warnings to observe how frequent they are used

18. 2002Daniel L. Silver18 Break down of a Cookie C:\Program Files\Netscape\ Users\defaultuser\cookies.txt C:\Program Files\Netscape\ Users\defaultuser\cookies.txt www.goto.com FALSE / FALSE1293231196 UserID 7481BA1DC3F68F71 www.goto.com FALSE / FALSE1293231196 UserID 7481BA1DC3F68F71 First Boolean value (FALSE) indicates whether the cookie is available throughout the domain, the second denotes whether the cookie data should be transmitted only over secure channels First Boolean value (FALSE) indicates whether the cookie is available throughout the domain, the second denotes whether the cookie data should be transmitted only over secure channels 1293231196 is the expiry date = milliseconds since 1970 1293231196 is the expiry date = milliseconds since 1970 UserID is the cookie name UserID is the cookie name 7481BA1DC3F68F71 is the cookie data 7481BA1DC3F68F71 is the cookie data

19. 2002Daniel L. Silver19 Cookies are Useful Saving user preferences and profile Saving user preferences and profile Remembering pages visited and when Remembering pages visited and when Greeting people by name Greeting people by name Notifying visitor of changes since last visit Notifying visitor of changes since last visit Retaining data from one page (or frame) to another Retaining data from one page (or frame) to another Using server side code cookie data can be used track user visits and movement patterns Using server side code cookie data can be used track user visits and movement patterns

20. 2002Daniel L. Silver20 Cookie Examples Javascript (client controlled) example: Samplecookie1.htm Javascript (client controlled) example: Samplecookie1.htm Samplecookie1.htm Java servlet (server controled) example: Servercookies.html Java servlet (server controled) example: Servercookies.html Servercookies.html

21. 2002Daniel L. Silver21 Web References http://www.jmarshall.com/easy/cgi/ http://www.jmarshall.com/easy/cgi/ http://www.jmarshall.com/easy/cgi/ http://www.library.uq.edu.au/quik-it/pub_adv.html#forms http://www.library.uq.edu.au/quik-it/pub_adv.html#forms http://www.library.uq.edu.au/quik-it/pub_adv.html#forms http://www.nlc-bnc.ca/pubs/netnotes/notes19.htm http://www.nlc-bnc.ca/pubs/netnotes/notes19.htm http://www.nlc-bnc.ca/pubs/netnotes/notes19.htm http://hoohoo.ncsa.uiuc.edu/cgi/ http://hoohoo.ncsa.uiuc.edu/cgi/ http://hoohoo.ncsa.uiuc.edu/cgi/ http://www.cgidir.com/ http://www.cgidir.com/ http://www.cgidir.com/ http://cgi.resourceindex.com/ http://cgi.resourceindex.com/ http://cgi.resourceindex.com/

22. THE END danny.silver@acadiau.ca