Module 7 Lecture Notes

635.482: Website Development

CGI Programming
CGI stands for the Common Gateway Interface. This term refers to a method that sends client requests
from a browser to a server asking the server to execute some program or script, resulting in a response to
the client, as well as possible side effects on the server. CGI allows a client request to execute a program
on the server. This allows the resulting web page to be tailored to the user's request (possibly both text
and graphics). This also allows data input from the user to be stored in the server.

Note that since the execution of the CGI programs are done via the HTTP server, pages that make use of
CGI scripts cannot be run locally. You must run the input through the HTTP server, and the server must
be configured properly to allow the CGI scripts to run.

CGI programs are often associated with form input from the user, but they do not have to be. Most web
servers can be configured to only allow CGI programs to be executed from a limited set of locations for
obvious security reasons. You can also limit CGI to programs that reside in certain directories. On
web2.jhuep.com, it is under ~yourUserID/public_html/cgi-bin/. Make sure that your cgi files have 755
permissions (rwxr-xr-x). Refer back to our "Web Servers" module for details on this.

There are two methods for CGI programs to receive data from the user agent: the GET method and the
POST method. Both the data explicitly entered by the user, as well as implicit data (e.g. browser, the
URL, etc.), are made available to the CGI program.

The GET Method

With the GET method, the CGI variables and values are appended to the end of the URL. For example:

http://www.xyz.com?name=value&ame1=value1

It is advantageous to use the GET method, then, when you would like to allow users to bookmark the CGI
inputs as well as the URL.

When a CGI program is executed via the GET Method, it should look for the inputs in the environment
variable QUERY_STRING. In the C language, you can get that value by calling getenv
("QUERY_STRING"). The amount of data that can be transferred using the GET method is limited
however, by the server.

The POST Method

With the POST method, the data is sent to the server via HTTP. With this method, then, the user cannot
'bookmark' the CGI data (since it is not part of the URL). However, the amount of data that can be sent
from the browser to the server is unlimited.

With the POST Method, the server CGI program reads Standard Input (STDIN) to get the CGI input. The
amount of data that is to be read from STDIN is contained in the environment variable
CONTENT_LENGTH. When using this method, your CGI program should read from STDIN until
CONTENT_LENGTH characters have been read.

1
URL Encoding
Since, particularly with the GET method, CGI input cannot contain certain characters (such as spaces or
forward slashes) that input is encoded into a form which is guaranteed not to conflict with special
characters. Special characters are translated into trigraphs (%HH), where HH are two hexadecimal digits.

For example, the URL encoded string 1%2B2%3D12%2F3 translates to 1+2=12/3 since:

%2B translates to '+'

%3D translates to '='
%2F translates to '/'

Most languages typically used for CGI programs have publicly available library routines to perform
decoding of the CGI inputs

How CGI Works

The server determines, based on directory or extension, if a request should be handled as a CGI rather
than a static request for a page. The server then issues fork() and exec() to clone a process and execute
the CGI program in that new process. Next, the program reads from STDIN and environment variables
and creates and writes an HTML page to STDOUT. After the CGI program terminates, the server adds
headers and passes HTML to the client.

Environment Variables

The server establishes a number of environment variables for the CGI:

• CONTENT_LENGTH
• CONTENT_TYPE
• QUERY_STRING
• REQUEST_METHOD
• REMOTE_HOST - the client
• SERVER_NAME
• HTTP_COOKIE
• HTTP_USER_AGENT

2
Languages for CGI
CGI scripts can be written in almost any programming language that can create a "filter" (reads STDIN
and writes STDOUT). Probably the most popular language for CGI is Perl (Practical Extraction and
Report Language) which is an interpreted language that, although originally written for UNIX, can run on
just about any platform and operating system. (Perl is a good choice for CGI programming due to its rich
ability to manipulate strings.) But, if you are an expert in C, C++, Java, shell scripts or batch scripts in
Windows you can use those languages to write programs that run under CGI. Keep in mind that the
portability of these languages isn't quite as important, since you likely will stick with one operating system
for the web server, and the web server is where the CGI programs run. However, if you create CGI scripts
on one platform and operating system, and then later want to move your web site to a different operating
system and platform, you may be disappointed that you didn't choose a more portable language for your
CGI programs.

Here is a simple CGI batch file that will work with Windows (if your web server runs on a Windows
machine). This program causes "Hello World" to be rendered on a user's web browser:

@echo off
echo "content-type: text/plain"
echo.
echo "Hello, world!"

If you want to display the CGI environment variable s on a Windows platform:

@echo off
echo "content-type: text/plain"
echo.
set

Here is a simple Perl script that causes "Hello World" to be rendered on a user's web browser:

#!/usr/bin/perl
# hello.pl -- my first perl script!
print "Content-type: text/html\n\n";
print "Hello, world!\n";

Here is another example of CGI using Perl, the html page asks for inputs to calculate the number of rolls
of wallpaper needed to cover a wall:

#!/usr/bin/perl
#calculates required number of single rolls of wallpaper
#and creates a dynamic Web page that contains
#form data and the required number of rolls
print "Content-type: text/html\n\n";
use CGI qw(:standard -debug);

#prevent Perl from creating undeclared variables

use strict;

#declare variables
my ($len, $wid, $hgt, $cov, $rolls);

#assign values to variables

$len = param('Length');
$wid = param('Width');
$hgt = param('Height');

3
 $cov = param('Coverage');

#calculate rolls
$rolls = ($len + $wid) * 2 * $hgt / $cov;

#create Web page

print "<!DOCTYPE html>\n";
print "<head><title>The Paper Tree</title><head>\n";
print "<h1>Single Roll Calculation</h1>";
print "<body>\n";
print "<table>\n";
printf "<tr><td>Length:</td><td align=right>%.1f</td></tr>", $len;
printf "<tr><td>Width:</td><td align=right>%.1f</td></tr>", $wid;
printf "<tr><td>Height:</td><td align=right>%.1f</td></tr>", $hgt;
printf "<tr><td>Coverage:</td><td align=right>%.1f</td></tr>", $cov;
printf "<tr><td>Required rolls:</td><td align=right>%.0f</td></tr>", $rolls;
print "</table>";
print "</body>\n";
print "</html>\n";

This html file calls the CGI script:

Calculation script

Additional Resources

• The CGI specification

• CGI 101

What is PHP?
Unlike client side processing, there are many different types of scripting languages which work on the
server side. Interestingly, JavaScript itself has a server-side implementation - the language is much the
same, but some of the built in functions are different on the server side. Server-side JavaScript is no
where near as popular as client-side JavaScript. Other examples of server-side scripting include Active
Server Pages (ASP), Python, and Ruby. One of the more popular server side scripting languages is PHP,
and we will be introduced to that scripting language in this module.

Server-side scripts can still be embedded in the HTML file created by the web developer, just like the
client-side scripts. However, these scripts are executed on the server, before the page is served to the
client browser. Thus, the client browser never even sees the server-side script itself, only the results of
the execution of the scripts. This can make these pages hard to validate, since the output of the script will
be validated, rather than the original page source. Also, since the web server executes the script as the
page is served up to the client, the web server must be configured to accept and process the server side
script (or else the client will simply see the unexecuted server-side source, which certainly would not be
the desired result. For example, ASP web pages usually only work on Microsoft .NET capable servers.
UNIX-based web servers (e.g. Apache) usually can support PHP or JSP (even ASP with the appropriate
module).

PHP originally stood for "Personal Home Page", but as it evolved, the acronym eventually took on a
recursive meaning, "PHP: Hypertext Processor". You can find out some of the history of this language
here.

4
Creating a PHP web page is simple. Usually, a web page containing PHP must have the suffix '.php' to
signal to the web server that this web page should be processed by PHP before it is sent to the browser.
Our server, web2.jhuep.com, supports PHP processing. Try bringing up this PHP file in your browser:

hello.php

If you look at the source of this file in your web browser, there is no PHP to be seen. That again, is
because the server has processed the PHP instructions and what you see is the end result. Here is the
original web page as it sits on the server:

<!DOCTYPE html>
<html lang="en">

<head>
<meta charset="utf-8">
<title>My First PHP</title>
</head>
<body>

<?php
echo "Hello World";
?>

</body>
</html>

PHP which is embedded in the web page is enclosed in "<?php" and "?>".

To learn more about the PHP language, you can go to the popular w3schools site for their information on
PHP.

In this reference (which includes this brief introduction above), you should cover all the sections under
"PHP Tutorial" (from the left hand column) and “PHP Forms.” Under "PHP Advanced", cover the first five
sections (up to and including “PHP File Create/Write”). For your next assignment, you will use PHP to
read and write files to our server. This is one advantage PHP has over CGI, at least on our server - with
CGI, file access is more tightly controlled, but with PHP you can read and write files right into your own
directory.

This will be all the provided content for this module - we will do something different over the next two
weeks with the forum - we will use that to learn other aspects of PHP outside of the material you covered
in the "w3schools" site.