Using CGI, Second Edition

InformationWeek 500 Conference -- September 14-16, 2008 Registed Today!

IMMERSE YOURSELF:

Storage & Servers

Using CGI, Second Edition

Reviewed by Donald Bryson

By Jeffry Dwight, Michael Erwin and Robert Niles
779 pages. 20 pages of contents; Appendix; 32 pages of index
ISBN 0-789 7-1139-7, paperback $49.99

Here's a Web page of source code, programs, and examples from the book .

Available at a discount from Amazon.com on this page

Technical Level: computing -- professional, subject -- experienced
Information: concepts: good; practice: good
Readability: textbook: good; reference: good
Summary: A general overview of the theory, tools, and techniques of CGI (Common Gateway Interface). There is a survey of the various tools available for Windows, UNIX, and Apple.

Publisher:
Que Corporation
201 W. 103rd Street, Indianapolis, Indiana 46290
http://www.mcp.com/que

REVIEW

I have a confession, while I've programmed on UNIX systems for years and even designed a Web site, CGI has been a dark art best left to the mystical Internet Illumina ti. However, the winds of change are blowing. SCO (Santa Cruz Operation) is telling commercial developers to move our programs to a Web-based user interface. While that's good sound marketing advice, it's like telling Sir Lancelot to grab a gun because the blacksmith just invented the musket. It's obvious advice that's usually resisted at first.

Well, I'm resisting no longer. I've decided to no longer grope in the dark ages of terminal emulators and curses routines. I'm jumping onto the Webtop with both feet and Using CGI is a good book to ease the landing. It has answered most of my questions and left me with an excitement to learn more. It explains general principles, shows possibilities, defines terms, and cautions against those special problems associated with CGI.

So, what did I learn about CGI? It's not so dark and mysterious. CGI works because it is a very simple interface. CGI gets its input from both environment variables and standard input. It then writes output to standard output. That sounds like an exercise from the first chapter of an introductory C programming book. Using CGI breaks this process down to ten basic steps:

Your browser decodes the first part of the URL and contacts the server.
Your browser supplies the remainder of the URL to the server.
The server translates the URL into a path and file name.
The server realizes that the URL points to a program instead of a static file.
The server prepares the environment and launches the CGI program.
The CGI program reads the environment variables and STDIN.
Next, the CGI writes the proper MIME headers to STDOUT for the forthcoming content.
Then the CGI sends the rest of its output to STDOUT and terminates.
The server notices that the CGI program has finished and closes the connection to your browser.
Your browser displays the output from the script.

Of course, step eight could include other processing by the CGI. For instance, it may write a log file to disk, or invoke an external program, like sendmail, to deliver an email message.

The authors treat the subjects of security, testing, and error handling exceptionally well. They strongly exhort us to always validate input. Why? With a compiled CGI program (for instance, C, C++, assembler), crackers can overflow input buffers in order to push machine instructions into the instruction space. Even a simple shell script can be coiled into an asp if you don't validate its input. Consider a script that prompts the user for a file name to cat the file. Wouldn't it ruin your day when someone enters:

file.txt;rm -rf /

Always validate input.

The book also contains several good examples of someone gaining unauthorized access to sensitive files by typing full path names instead of the relative file name the programmer expected. There is a big difference between someone typing ``products.txt'' and ``/etc/pa sswd''. The authors also remind us that PostScript is a full-featured programming language that can be maliciously misused. For instance, the PostScript operators ``deletefile'' and ``renamefile'' are obvious problems. You should always use a helper application that doesn't allow potentially harmful operations, like GNU Ghostscript 2.6.1 (or a later version).

Testing is discussed in an experienced manner with sound programming advice. For example, ``play dumb'' when testing your own code. Forget how the program should be used and enter the ridiculous. Eventually, someone will do that and you should be the first to see what happens.

My favorite quote, which now hangs in my office, is on error handling:

How you detect errors in your code can be a good reflection about how you approach life: The foolishly bold simply ignore error checking, on the assumption that things can't possibly go wrong. The optimistic may check for errors, but figure that the odds of them actual ly happening are small enough to not require much effort or explanation. The pessimistic -- though no fun at parties -- often write the best code, not only checking for errors, but also individually identifying each for easy tracking. When you're programming CGI scripts, the worse your outlook is, the better your code will be.

Strong Points

The writing is clear, concise, and entertaining.
The book has a sharp focus. With the exception of the unnecessary chapter on video, everything relates to the subject.
The book is full of links to useful sites.