[tpm] CGI

[Liam R E Quin]

On Thu, 2007-10-18 at 02:01 +0000, s z wrote:
> this is a second post. Please comment on the issue. I appreciate your
> help. Thank you in advance.

You already had one reply I think.

Let's take a higher-level look at the problem.

States are:
[1] issue blank form to user
[2] receive data
    2a data is not OK, go back to [1] but with correct fields still
    there
    2b data is OK, proceed to [3]
*important* people can edit data in Web forms, never ever trust it!
never ever display user data in error messages unless you escape
all special characters like < & > ' " where needed.  Otherwise
your site is vulnerable to a cross-site scripting attack, or
can be used to attack another site, or can be used to host links
to porn sites inside those error messages!

[3] data is OK, update the dataqbase
    3a failed, go back to [1] with an explanation
    3b OK, so proceed to [1] with a note that everything was OK

You can do all this with a single CGI script.  I make it easier
for myself with a hidden input field that supplies a state parameter,
although you still need to check the data is OK of course, as someone
can always add the parameter right there in the URL!

mypage.cgi looks like

if (data_was_ok) {
    initial_page(message)
} elsif (got_data) {
    if (data_is_bad) {
        initial_page("data was bad"); # do better than this!
    } elsif (store_data()) {
        initial_page("data stored.");
    } else {
        initial_page("failed to store data");
   }
} else {
    initial_page()
}

Now you only need one program and the logic is fairly clear.

The initial_page() routine would of course send the HTML forms,
populated with data if supplied, and with an optional message at the
start.

If you really do end up wanting to share code between different scripts,
you may want to learn about modules, although an alternative is just
to call the other script with system() (if you are VERY careful not
to pass command-line arguments, or to quote them properly, so that
a value of `/bin/rm -rf /` does not delete every file on your server...
people WILL try this sort of thing)

Liam


-- 
Liam Quin - XML Activity Lead, W3C, http://www.w3.org/People/Quin/
Pictures from old books: http://fromoldbooks.org/
Ankh: irc.sorcery.net irc.gnome.org www.advogato.org