Anatomy of the Web Bomb: Part 1

Common Gateway Interface (CGI) programming involves peculiar flows of control and data. Follow the solid black arrows to trace the flow of control from programs to documents to programs to documents as the Web BOMB works. Follow the red, numbered circles to trace the flow of the three items of data -- the article's issue (1) , section (2) , and title (3) -- that make the Web BOMB context-sensitive.

A. Don't even think about publishing a large collection of documents on the Web unless you can automatically generate those documents.

I could have used Perl for this job, but Epsilon's EEL seems even better. I like how EEL supports both declarative and navigational text processing. You can do the same kinds of global regular-expression searching and replacing that Perl can do. But you can also programmatically wield all the navigational and interactive powers of a text editor: searching forward and backward, inserting text, and jumping to locations.

B. HTML, like PostScript, is a language that should mostly be written by programs rather than by humans. Unlike PostScript, though, HTML is easy to write. That makes Web development very convenient.

When you want to use a program-generated form like this one, first write it out by hand and test it in your browser. When it works the way you want, you've got a specification for the document that your program must write.

C. You launch a CGI program by clicking on a link. Here the link is textual -- it's the word Comment. To create this kind of link, you write HTML source like this:

<a href=/cgi-bin/perl.exe?cmt2.pl+arg1+arg2>Comment</a>

Alternatively, you can make the link graphical. To do that, you write HTML source like this:

<a href=/cgi-bin/perl.exe?cmt2.pl+args><img src=cmt.gif></a>

Note: With most Web servers, the CGI link actually looks like this:

<a href=/c gi-bin/cmt2.pl?args>

Invocation of the Perl interpreter is implicit. However, NT servers derived from EMWAC's code require explicit invocation of Perl. Isn't that dangerous, I wondered? What's to keep a user from entering a URL like

http://www.byte.com/cgi-bin/perl.exe?-e+unlink+*.*

using Perl's "enter a line of script on the command line" feature to trash a bunch of files -- or worse? Process Software agreed this is a problem, and it will have a fix in Purveyor 1.1.

D. Web servers communicate a number of environment variables to back-end CGI programs. Here, Perl gets the referring article's URL from the HTTP_REFERER variable. It will be a string like this:

http://www.byte.com/art/9502/sec1/art1.htm

Separately, Perl saves the issue, section, and title information passed to it on the command line.