HTML 4.0 Sourcebook
(Publisher: John Wiley & Sons, Inc.)
Author(s): Ian S. Graham
ISBN: 0471257249
Publication Date: 04/01/98

FastCGI: A CGI Program Accelerator

www.fastcgi.com/

CGI programs are slowed by the fact that they need to be loaded into memory every time they are called—that is, they begin from a standing start, every time. This startup time can be almost eliminated by using FastCGI. FastCGI acts like a second server, running next to the HTTP server and acting as the general-purpose gateway between the Web server and the CGI programs. The difference is that, in this case, the CGI programs are incorporated into the FastCGI engine, using a special FastCGI API. Thus, writing FastCGI programs is like writing programs that bind to a server API, except that here the FastCGI API is independent of the server and was designed to work in a manner similar to traditional CGI. Indeed, there are FastCGI interfaces to most servers, so that FastCGI applications are almost as portable as regular CGI programs.

FastCGI was developed by Open Market Inc., but is now a free public-domain package that can be openly used and ported to any server. FastCGI programs can be written in almost any language, including perl, C, python, and Java.

CGI Programming Libraries

One of the most tedious aspects of CGI programming is parsing the environment variables or standard input data—these data are encoded, and a gateway program must decode the information before it can be used. To help in this process, a programmer can use one of the many programming libraries, available in a variety of languages, that provide routines for doing these basic tasks. Many of these have additional tools for generating HTML content for the returned document or for accessing databases. This section describes the more popular libraries of this type. You should look to the references at the end of the chapter for information about newer resources.

CGI.pm: Perl 5 Library

www-genome.wi.mit.edu/ftp/pub/software/WWW/cgi_docs.html

CGI.pm, by Lincoln Stein, is the most complete of the perl 5 CGI programming libraries. There are modules for parsing and processing form data, including those sent using the multipart/form-data encoding, for generating FORM-based HTML documents to return to the client and for error checking and report generation. The package is complicated, complete, and highly recommended. The package can be thought of as a more sophisticated (and complicated) successor to the cgi-lib.pl package (see later). However, the library is large, and thus can be slow to start up—for smaller, faster perl applications, see cgi-lite.pm.

Cgic: ANSII C Library

www.boutell.com/cgic/

Cgic, by Thomas Boutell, is a free (non-commercial use only) library of C-language routines for parsing and manipulating FORM data. Cgic contains modules for exception and error handling, and for handling standard processing functions, such as bounds checking and multiple-choice selection; it can even check for well-known browser errors. There is also a debugging mode. The package can run under UNIX and also under DOS/Windows.

Cgi-lib.pl: Perl 4/5 Library

cgi-lib.stanford.edu/cgi-lib/

Cgi-lib.pl, by Steven Brenner, is one of the most popular perl libraries for CGI program development. It is simple, compatible with both perl 4 and 5, and can handle data sent using the multipart/form-data encoding. There are also modules for constructing standard HTML headers and footers for the returned data. Cgi-lib.pl is simpler than CGI.pm, but provides less functionality. It is also smaller and faster than CGI.pm, but not as fast as cgi-lite.pm.

Cgi-lite: Perl 5 Library

www.oasis.leo.org/perl/exts/infosys/www/cgi/

Cgi-lite.pm, by Shishir Gundavaram, is a small CGI library for processing form data. It is modeled, to some degree, after CGI.pm, but omits many of the advanced CGI.pm features. The advantage of cgi-lite.pm is speed—since it is much smaller, it is much faster to launch and is ideal when the CGI program needs to be fast.

Libcgi++: C++ Library

www.ncsa.uiuc.edu/People/daman/cgi++/

Libcgi++, by Dragos Manolescu, is a C++ library for parsing and processing data obtained from GET and POST requests. There are routines for parsing and decoding query strings, for encoding data for return to a client, and so on.

Uncgi

www.midwinter.com/ftp/pub/

Uncgi, by Steven Grimm, is a simple front-end package that handles form element parsing. Uncgi decodes all the NAME and VALUE attribute values sent by GET or POST methods, and places them in environment variables. Uncgi then calls the processing program (C, perl, or whatever), passing it these environment variables. Note that this may be a problem if the string being passed in an environment variable becomes too large, since some systems place limits on the size of environment variables.

Generic Web Application Libraries

There are two additional libraries that are useful for CGI programming, but that were originally designed for writing general-purpose Web applications, such as clients (browsers or other), servers, or Web indexing robots.

Libwww: W3C Sample Code Library

www.w3.org/Library/

Libwww is a general-purpose Web API written in C. Libwww is a highly modular, extensible API that is commonly used as the code base for Web clients and robots and for developing and testing experimental Web-based protocols and software.

Libwww-perl: Library for Web Applications

www.ics.uci.edu/pub/websoft/libwww-perl/

Libwww-perl, by Roy Fielding of the University of California at Irvine, is a perl library package of perl (Version 4 and 5) functions and provides a useful library and API for writing client and server Web applications. This package is highly recommended to any serious Web programmers. Note, however, that libwww-perl was not designed specifically for CGI programming and is not ideal for CGI applications. Development of the perl 4 package stopped in late 1994, so you should use the perl 5 version whenever possible.

CGIwrap: Security Wrapper

wwwcgi.umr.edu/~cgiwrap/

As mentioned previously, CGI programs pose a number of security risks. CGIwrap is a gateway program designed to reduce these security risks. With CGIwrap, CGI programs run with the permissions of the user who owns the program and not with those of the Web server that launches it. This makes it easier for users to write and run their own CGI programs, with reduced risk that these programs can damage other users’ resources.

CGIwrap reduces, but does not eliminate, security problems. If you want to properly understand CGI security issues, you should read the security references listed at the end of Chapter 10.

Server-Side Document Parsing

The SSI mechanism works through a parsing module incorporated into the HTTP server. Of course, it is easy to build additional modules that support other forms of parsable markup within HTML documents. Indeed, most commercial Web servers support server-side scripting via proprietary scripting languages; for example, Netscape’s LiveWare suite provides JavaScript-based server-side scripting, while Microsoft’s Active Server Pages technology provides similar functionality on Microsoft servers.