ch22.htm

《Perl 5 Unreleased》

</BLOCKQUOTE>
<BLOCKQUOTE>
<TT><FONT FACE="Courier">&nbsp;1 &lt;html&gt;&lt;head&gt; &lt;TITLE&gt;Sample
Credit Form&lt;/TITLE&gt;<BR>
&nbsp;2 &lt;/head&gt;<BR>
&nbsp;3 <BR>
&nbsp;4 &lt;body&gt;<BR>
&nbsp;5 &lt;center&gt;&lt;h1&gt;Sample Credit Application Form&lt;/h1&gt;&lt;/center&gt;
<BR>
&nbsp;6 &lt;hr&gt;<BR>
&nbsp;7 &lt;FORM METHOD=&quot;POST&quot; ACTION=&quot;http://ikra.com/cgi-bin/credit.pl&quot;&gt;
<BR>
&nbsp;8&nbsp;&nbsp;First Name &lt;INPUT SIZE=20 NAME=&quot;fname&quot;&gt;
<BR>
&nbsp;9&nbsp;&nbsp;Last Name&nbsp;&nbsp;&lt;INPUT SIZE=20 NAME=&quot;lname&quot;&gt;
&lt;BR&gt;<BR>
10&nbsp;&nbsp;Social Security Number &lt;INPUT SIZE=12 NAME=&quot;ssn&quot;&gt;
<BR>
11&nbsp;&nbsp;Mom's Maiden Name &lt;INPUT SIZE=20 NAME=&quot;mname&quot;&gt;
&lt;BR&gt;<BR>
12 &lt;HR&gt;<BR>
13 &lt;H4&gt;Type of Cards Desired&lt;/H4&gt;<BR>
14 &lt;INPUT TYPE=&quot;CheckBox&quot; VALUE=&quot;VISA&quot;
NAME=&quot;visa&quot;&gt;VISA<BR>
15 &lt;INPUT TYPE=&quot;CheckBox&quot; VALUE=&quot;MCRD&quot;
NAME=&quot;mastercard&quot;&gt;Mastercard<BR>
16 &lt;P&gt;<BR>
17 &lt;HR&gt;<BR>
18 &lt;H4&gt;Number of Dependants&lt;/H4&gt;<BR>
19 &lt;SELECT NAME=&quot;dependants&quot; SIZE=&quot;1&quot;&gt;
<BR>
20 &lt;OPTION SELECTED&gt;1<BR>
21 &lt;OPTION&gt;2<BR>
22 &lt;OPTION&gt;3<BR>
23 &lt;OPTION&gt;4<BR>
24 &lt;OPTION&gt;5<BR>
25 &lt;OPTION&gt;6<BR>
26 &lt;/SELECT&gt;<BR>
27 &lt;HR&gt;<BR>
28 &lt;H4&gt;Yearly Income&lt;/H4&gt;<BR>
29 &lt;INPUT TYPE=&quot;Radio&quot; VALUE=&quot;1&quot; NAME=&quot;income&quot;&gt;0-10K
<BR>
30 &lt;INPUT TYPE=&quot;Radio&quot; VALUE=&quot;2&quot; NAME=&quot;income&quot;&gt;10-20K
<BR>
31 &lt;INPUT TYPE=&quot;Radio&quot; VALUE=&quot;3&quot; NAME=&quot;income&quot;&gt;20-30K
<BR>
32 &lt;INPUT TYPE=&quot;Radio&quot; VALUE=&quot;4&quot; NAME=&quot;income&quot;&gt;30-40K
<BR>
33 &lt;INPUT TYPE=&quot;Radio&quot; VALUE=&quot;5&quot; NAME=&quot;income&quot;&gt;40-50K
<BR>
34 &lt;INPUT TYPE=&quot;Radio&quot; VALUE=&quot;6&quot; NAME=&quot;income&quot;&gt;50K+
<BR>
35 &lt;HR&gt;<BR>
36&nbsp;&nbsp;&lt;INPUT TYPE=&quot;Reset&quot; VALUE=&quot;Clear
Form&quot;&gt;<BR>
37&nbsp;&nbsp;&lt;INPUT TYPE=&quot;Submit&quot; VALUE=&quot;Submit&quot;&gt;
<BR>
38&nbsp;&nbsp;&lt;/FORM&gt;<BR>
39 <BR>
40 &lt;/body&gt;&lt;/html&gt;</FONT></TT>
</BLOCKQUOTE>
<HR>
<P>
Here is the output from the <TT><FONT FACE="Courier">credit.pl</FONT></TT>
Perl script:
<P>
<TT><FONT FACE="Courier">=============================================</FONT></TT>
<BLOCKQUOTE>
<TT><FONT FACE="Courier">SERVER_NAME = pop.ikra.com<BR>
REQUEST_METHOD = POST<BR>
SCRIPT_NAME = /cgi-bin/credit.pl<BR>
QUERY_STRING =<BR>
CONTENT_TYPE = application/x-www-form-urlencoded<BR>
CONTENT_LENGTH = 91<BR>
income is set to 5<BR>
ssn is set to 123-45-6789<BR>
lname is set to Doe<BR>
dependants is set to 4<BR>
mastercard is set to MCRD<BR>
mname is set to Jane Smith<BR>
fname is set to John</FONT></TT>
</BLOCKQUOTE>
<P>
In this output from the <TT><FONT FACE="Courier">POST</FONT></TT>
request, the <TT><FONT FACE="Courier">REQUEST_METHOD</FONT></TT>
is <TT><FONT FACE="Courier">POST</FONT></TT>, and the query string
is shown as empty! So where did all the user's input go? The input
has been pumped into the standard input of the Perl script. You
have to design your Perl script to pick the input from either
the <TT><FONT FACE="Courier">POST</FONT></TT> or <TT><FONT FACE="Courier">GET</FONT></TT>
requests automatically. Listing 22.5 illustrates how to process
both types of requests.
<HR>
<BLOCKQUOTE>
<B>Listing 22.5. The Perl script to handle </B><TT><B><FONT FACE="Courier">credit.html</FONT></B></TT><B>.
<BR>
</B>
</BLOCKQUOTE>
<BLOCKQUOTE>
<TT><FONT FACE="Courier">&nbsp;1 #!/usr/bin/perl<BR>
&nbsp;2 #<BR>
&nbsp;3 # The sample script file to show difference in<BR>
&nbsp;4 # handling POST and GET requests.<BR>
&nbsp;5 #<BR>
&nbsp;6 #<BR>
&nbsp;7 $|=1;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#
Flush immediately.<BR>
&nbsp;8 print &quot;Content-Type: text/plain\n\n&quot;;<BR>
&nbsp;9 <BR>
10 <BR>
11 print &quot;\n=============================================\n&quot;;
<BR>
12 print &quot;SERVER_NAME = $ENV{'SERVER_NAME'}\n&quot;;<BR>
13 print &quot;REQUEST_METHOD = $ENV{'REQUEST_METHOD'}\n&quot;;
<BR>
14 print &quot;SCRIPT_NAME = $ENV{'SCRIPT_NAME'}\n&quot;;<BR>
15 print &quot;QUERY_STRING = $ENV{'QUERY_STRING'}\n&quot;;<BR>
16 print &quot;CONTENT_TYPE = $ENV{'CONTENT_TYPE'}\n&quot;;<BR>
17 print &quot;CONTENT_LENGTH = $ENV{'CONTENT_LENGTH'}\n&quot;;
<BR>
18 <BR>
19 if ( $ENV{'REQUEST_METHOD'} eq &quot;GET&quot; &amp;&amp;<BR>
20&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$ENV{'QUERY_STRING'} ne
'') {<BR>
21&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$form = $ENV{'QUERY_STRING'};
<BR>
22&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<BR>
23 elsif ( $ENV{'REQUEST_METHOD'} eq &quot;POST&quot; ) {<BR>
24&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;read(STDIN,$form, $ENV{'CONTENT_LENGTH'});
<BR>
25 } else {<BR>
26&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;print &quot;\n At least fill something!
I cannot work with empty strings&quot;;<BR>
27&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;exit;<BR>
28&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<BR>
29 <BR>
30 #<BR>
31 # Now the variable $form has your input data.<BR>
32 # Create your associative array.<BR>
33 #<BR>
34&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;foreach $pair (split('&amp;',
$form)) {<BR>
35&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if ($pair
=~ /(.*)=(.*)/) {&nbsp;&nbsp;# found key=value;<BR>
36&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;($key,$value)
= ($1,$2);&nbsp;&nbsp;&nbsp;&nbsp; # get key, value.<BR>
37&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$value
=~ s/\+/ /g;&nbsp;&nbsp;# substitute spaces for + signs.<BR>
38&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$value
=~ s/%(..)/pack('c',hex($1))/eg;<BR>
39&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$inputs{$key}
= $value;&nbsp;&nbsp; # Create Associative Array.<BR>
40&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<BR>
41&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<BR>
42&nbsp;<BR>
43 foreach $item (keys(%inputs)) {<BR>
44&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;print &quot;$item is set to $inputs{$item}\n&quot;;
<BR>
45 }<BR>
Lines 19 through 28 contain fragments of code that actually determine
where to pick up the input.</FONT></TT>
</BLOCKQUOTE>
<HR>
<P>
Basically, this script handles the input for a <TT><FONT FACE="Courier">GET</FONT></TT>
request with non-empty input and a <TT><FONT FACE="Courier">POST</FONT></TT>
request with any input. At the end of this conditional, <TT><FONT FACE="Courier">$form</FONT></TT>
has the input string in a URL-encoded form. Obviously, this kind
of data handling is not acceptable in a real-life scenario. The
parsing of the incoming input to figure out if it's <TT><FONT FACE="Courier">POST</FONT></TT>
or <TT><FONT FACE="Courier">GET</FONT></TT> has to be done so
many times and in so many shell scripts that it's really a good
idea to simply write a subroutine that handles both types of processing.
Once you have such a subroutine defined, all you have to do is
simply include it in the rest of the CGI scripts to extract the
incoming parameters. 
<P>
In either case, the output of the Perl script is what is sent
back to the calling browser. In other words, all the words written
to <TT><FONT FACE="Courier">STDOUT</FONT></TT> (the default if
a file handle is not specified in the <TT><FONT FACE="Courier">print</FONT></TT>
statement) are sent the browser. In fact, the output is forced
to be flushed as soon as possible with the use of the <TT><FONT FACE="Courier">$|=1</FONT></TT>
command.<P>
<CENTER>
<TABLE BORDERCOLOR=#000000 BORDER=1 WIDTH=80%>
<TR VALIGN=TOP><TD ><B>Tip</B></TD></TR>
<TR VALIGN=TOP><TD >
<BLOCKQUOTE>
You have to deal with handling any errors in input. Imagine the type of input your script might receive if your user walks away from his desk and his three-year-old gets to do some typing! Always check for input into your CGI form. It's better to be safe 
than sorry.</BLOCKQUOTE>

</TD></TR>
</TABLE></CENTER>
<P>
<P>
In Listing 22.5, lines 19 through 28 will parse the incoming parameters
into an associative array called <TT><FONT FACE="Courier">inputs</FONT></TT>.
Look at what you have parsed into the incoming <TT><FONT FACE="Courier">inputs</FONT></TT>
associative array from a test run. The output of what the values
that were entered in the form and sent to the script are set in
<TT><FONT FACE="Courier">inputs</FONT></TT>:
<BLOCKQUOTE>
<TT><FONT FACE="Courier">%inputs{'income'} is set to 5<BR>
%inputs{'ssn'} is set to 123-45-6789<BR>
%inputs{'lname'} is set to Doe<BR>
%inputs{'dependants'} is set to 4<BR>
%inputs{'mastercard'} is set to MCRD<BR>
%inputs{'mname'} is set to Jane Smith<BR>
%inputs{'fname'} is set to John</FONT></TT>
</BLOCKQUOTE>
<P>
If you look at the HTML file that invoked this script, you'll
recognize some of the indices in the <TT><FONT FACE="Courier">%inputs</FONT></TT>
array. The keys used to index into the <TT><FONT FACE="Courier">%inputs</FONT></TT>
array were set in the HTML document. They have now been passed
into the Perl script for use. The<FONT FACE="AGaramond Bold">
</FONT><TT><FONT FACE="Courier">%inputs</FONT></TT><FONT FACE="AGaramond Bold">
</FONT>array now has all the values for you to work with.
<P>
Of course, you always have to check the incoming values to see
if they make sense. There are several ways to check the input
for your credit card application example. You could check if the
social security number has the right number of digits, if all
the fields were filled in, and so on. One possible way to check
the input is shown in Listing 22.7. Note how each variable is
tested for a range of values and to see if it's empty. In your
HTML pages and CGI scripts, you must check for missing or inconsistent
responses. Prepare for the worst-case scenario.
<P>
The tedious part is checking for all the possible responses that
your user can type in. Checking for non-zero responses, empty
strings, and out-of-range values takes time in execution and in
setting up tests. However, the time will be well spent if the
users of your page are not given <TT><FONT FACE="Courier">Server
Error</FONT></TT> messages, or, even worse, data on bad input
without even a whimper of an error message. This type of response
may lead to the user actually believing in the erroneous test
results.
<HR>
<BLOCKQUOTE>
<B>Listing 22.6. Checking for missing or inconsistent responses.
<BR>
</B>
</BLOCKQUOTE>
<BLOCKQUOTE>
<TT><FONT FACE="Courier">&nbsp;&nbsp;1 #!/usr/bin/perl<BR>
&nbsp;&nbsp;2 #<BR>
&nbsp;&nbsp;3 # The sample script file to show difference in<BR>
&nbsp;&nbsp;4 # handling POST and GET requests.<BR>
&nbsp;&nbsp;5 #<BR>
&nbsp;&nbsp;6 #<BR>
&nbsp;&nbsp;7 <BR>
&nbsp;&nbsp;8 $|=1;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#
Flush immediately.<BR>
&nbsp;&nbsp;9 print &quot;Content-Type: text/plain\n\n&quot;;
<BR>
&nbsp;10 <BR>
&nbsp;11 print &quot;\n=============================================\n&quot;;
<BR>
&nbsp;12 print &quot;SERVER_NAME = $ENV{'SERVER_NAME'}\n&quot;;
<BR>
&nbsp;13 print &quot;REQUEST_METHOD = $ENV{'REQUEST_METHOD'}\n&quot;;
<BR>
&nbsp;14 print &quot;SCRIPT_NAME = $ENV{'SCRIPT_NAME'}\n&quot;;
<BR>
&nbsp;15 print &quot;QUERY_STRING = $ENV{'QUERY_STRING'}\n&quot;;
<BR>
&nbsp;16 print &quot;CONTENT_TYPE = $ENV{'CONTENT_TYPE'}\n&quot;;
<BR>
&nbsp;17 print &quot;CONTENT_LENGTH = $ENV{'CONTENT_LENGTH'}\n&quot;;
<BR>
&nbsp;18 print &quot;SERVER_NAME = $ENV{'SERVER_NAME'}\n&quot;;
<BR>
&nbsp;19 print &quot;\n=============================================\n&quot;;
<BR>