ch14.htm

CGI programming is the hottest stuff to look out for in this book

<BLOCKQUOTE>
<TT><FONT FACE="Courier">If CGI_AuthUser = &quot;&quot; Then 'If
they haven't authenticated, do it<BR>
<BR>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Send &quot;HTTP/1.0
401 Unauthorized&quot;<BR>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Send (&quot;Server:
&quot; + CGI_ServerSoftware)<BR>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Send (&quot;Date:
&quot; + WebDate(Now))<BR>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Send (&quot;WWW-Authenticate:
Basic realm=&quot;&quot;AuthDemo&quot;&quot;&quot;)<BR>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Send (&quot;Content-type:
text/html&quot;)<BR>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Send (&quot;&quot;)
<BR>
<BR>
<BR>
' Anything after this is only seen if they click cancel,<BR>
'Insert code to handle cancel button<BR>
<BR>
Else 'They typed in a username/password<BR>
<BR>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;If (CGI_AuthUser
= &quot;Daniel Berlin&quot; And CGI_AuthPass = &quot;danny&quot;)
Then <BR>
'they got it right<BR>
<BR>
'Insert your own code here to deal with getting the name/password
right<BR>
<BR>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Else 'they got
it wrong<BR>
<BR>
'Insert your own code here to deal with getting the name/password
wrong.<BR>
<BR>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;End If<BR>
&nbsp;&nbsp;&nbsp;&nbsp;End If</FONT></TT>
</BLOCKQUOTE>
<P>
Most of the time, the name and password will be checked against
some kind of database. However, because I don't have such a database
handy, I hardcoded the name and password that will need to be
looked for.
<P>
This is basically a finished program that does authentication.
All I did to make it a real app was fill in my own code and throw
it in a <TT><FONT FACE="Courier">CGI_Main</FONT></TT> sub. See
Listing 14.2.
<HR>
<BLOCKQUOTE>
<B>Listing 14.2. Finished authentication program.</B>
</BLOCKQUOTE>
<BLOCKQUOTE>
<TT><FONT FACE="Courier">'Authentication Demo<BR>
'Copyright 1996 By Daniel Berlin<BR>
<BR>
Sub Inter_Main()<BR>
&nbsp;&nbsp;&nbsp;&nbsp;MsgBox &quot;This program is meant to
be run from the Web Server&quot;<BR>
&nbsp;&nbsp;&nbsp;&nbsp;Exit Sub<BR>
End Sub<BR>
Sub CGI_Main()<BR>
<BR>
&nbsp;&nbsp;&nbsp;&nbsp;If CGI_AuthUser = &quot;&quot; Then 'If
they haven't authenticated, do it<BR>
<BR>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Send &quot;HTTP/1.0
401 Unauthorized&quot;<BR>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Send (&quot;Server:
&quot; + CGI_ServerSoftware)<BR>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Send (&quot;Date:
&quot; + WebDate(Now))<BR>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Send (&quot;WWW-Authenticate:
Basic realm=&quot;&quot;AuthDemo&quot;&quot;&quot;)<BR>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Send (&quot;Content-type:
text/html&quot;)<BR>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Send (&quot;&quot;)
<BR>
<BR>
<BR>
' Anything after this is only seen if they click cancel,<BR>
' This is because if they don't, it calls the program again<BR>
<BR>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Send (&quot;&lt;HTML&gt;&lt;HEAD&gt;&lt;TITLE&gt;You
clicked Cancel&lt;/TITLE&gt;&lt;/HEAD&gt;&quot;)<BR>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Send (&quot;&lt;BODY&gt;&lt;H1&gt;You
Clicked Cancel&lt;/H1&gt;&lt;/BODY&gt;&lt;/HTML&gt;&quot;)<BR>
&nbsp;&nbsp;&nbsp;&nbsp;Else 'They typed in a username/password
<BR>
<BR>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;If (CGI_AuthUser
= &quot;Daniel Berlin&quot; And CGI_AuthPass = &quot;danny&quot;)
Then <BR>
'they got it right<BR>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Send
(&quot;Content-type: text/html&quot;)<BR>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Send
(&quot;&quot;)<BR>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Send
(&quot;&lt;HTML&gt;&lt;HEAD&gt;&lt;TITLE&gt;Congrats&lt;/TITLE&gt;&lt;/HEAD&gt;&quot;)
<BR>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Send
(&quot;&lt;BODY&gt;&lt;H1&gt;You have been properly authenticated&lt;/H1&gt;&lt;/BODY&gt;_
<BR>
&lt;/HTML&gt;&quot;)<BR>
<BR>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Else 'they got
it wrong<BR>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Send
(&quot;Content-type: text/html&quot;)<BR>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Send
(&quot;&quot;)<BR>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Send
(&quot;&lt;HTML&gt;&lt;HEAD&gt;&lt;TITLE&gt;I'm sorry&lt;/TITLE&gt;&lt;/HEAD&gt;&quot;)
<BR>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Send
(&quot;&lt;BODY&gt;&lt;H1&gt;Either username or password is wrong&lt;/H1&gt;&lt;/BODY&gt;_
<BR>
&lt;/HTML&gt;&quot;)<BR>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;End If<BR>
&nbsp;&nbsp;&nbsp;&nbsp;End If<BR>
<BR>
<BR>
End Sub</FONT></TT>
</BLOCKQUOTE>
<HR>
<P>
This just about wraps up authentication.
<P>
The source code for the WinCGI Framework for VB32 is given in
Listing 14.3.
<HR>
<BLOCKQUOTE>
<B>Listing 14.3. CGI32.BAS.<BR>
</B>
</BLOCKQUOTE>
<BLOCKQUOTE>
<TT><FONT FACE="Courier">Attribute VB_Name = &quot;CGI_Framework&quot;
<BR>
'----------------------------------------------------------------------
<BR>
'&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; *************<BR>
'&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; * CGI32.BAS *<BR>
'&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; *************<BR>
'<BR>
' VERSION: 1.7&nbsp;&nbsp;(December 3, 1995)<BR>
'<BR>
' AUTHOR:&nbsp;&nbsp;Robert B. Denny &lt;[e-mail]&gt;
<BR>
'<BR>
' Common routines needed to establish a VB environment for<BR>
' Windows CGI programs that run behind the WebSite Server.<BR>
'<BR>
' INTRODUCTION<BR>
'<BR>
' The Common Gateway Interface (CGI) version 1.1 specifies a minimal
<BR>
' set of data that is made available to the back-end application
by<BR>
' an HTTP (Web) server. It also specifies the details for passing
this<BR>
' information to the back-end. The latter part of the CGI spec
is<BR>
' specific to Unix-like environments. The ncSA httpd for Windows
does<BR>
' supply the data items (and more) specified by CGI/1.1, however
it<BR>
' uses a different method for passing the data to the back-end.
<BR>
'<BR>
' DEVELOPMENT<BR>
'<BR>
' WebSite requires any Windows back-end program to be an<BR>
' executable image. This means that you must convert your VB<BR>
' application into an executable (.EXE) before it can be tested
<BR>
' with the server.<BR>
'<BR>
' ENVIRONMENT<BR>
'<BR>
' The WebSite server executes script requests by doing a<BR>
' CreateProcess with a command line in the following form:<BR>
'<BR>
'&nbsp;&nbsp;&nbsp;prog-name cgi-profile<BR>
'<BR>
' THE CGI PROFILE FILE<BR>
'<BR>
' The Unix CGI passes data to the back end by defining environment
<BR>
' variables which can be used by shell scripts. The WebSite<BR>
' server passes data to its back end via the profile file. The
<BR>
' format of the profile is that of a Windows &quot;.INI&quot;
file. The keyword<BR>
' names have been changed cosmetically.<BR>
'<BR>
' There are 7 sections in a CGI profile file, [CGI], [Accept],
<BR>
' [System], [Extra Headers], and [Form Literal], [Form External],
<BR>
' and [Form huge]. They are described below:<BR>
'<BR>
' [CGI]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;==
The standard CGI variables<BR>
' CGI Version=&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;The
version of CGI spoken by the server<BR>
' Request Protocol=&nbsp;&nbsp;&nbsp;&nbsp;The server's info protocol
(e.g. HTTP/1.0)<BR>
' Request Method=&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;The method
specified in the request (e.g., &quot;GET&quot;)<BR>
' Request Keep-Alive=&nbsp;&nbsp;If the client requested connection
re-use (Yes/No)<BR>
' Executable Path=&nbsp;&nbsp;&nbsp;&nbsp; Physical pathname of
the back-end (this program)<BR>
' Logical Path=&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Extra
path info in logical space<BR>
' Physical Path=&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Extra path
info in local physical space<BR>
' Query String=&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;String
following the &quot;?&quot; in the request URL<BR>
' Content Type=&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;MIME
content type of info supplied with request<BR>
' Content Length=&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Length, bytes,
of info supplied with request<BR>
' Request Range=&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Byte-range
specfication received with request<BR>
' Server Software=&nbsp;&nbsp;&nbsp;&nbsp; Version/revision of
the info (HTTP) server<BR>
' Server Name=&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Server's
network hostname (or alias from config)<BR>
' Server Port=&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Server's
network port number<BR>
' Server Admin=&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;E-Mail
address of server's admin. (config)<BR>
' Referer=&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
URL of referring document<BR>
' From=&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;E-Mail
of client user (rarely seen)<BR>
' User Agent=&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;String
describing client/browser software/version<BR>
' Remote Host=&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Remote
client's network hostname<BR>
' Remote Address=&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Remote client's
network address<BR>
' Authenticated Username=Username if present in request<BR>
' Authenticated Password=Password if present in request<BR>
' Authentication Method=Method used for authentication (e.g.,
&quot;Basic&quot;)<BR>
' Authentication Realm=Name of realm for users/groups<BR>
'<BR>
' [Accept]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
&lt;== What the client says it can take<BR>
' The MIME types found in the request header as<BR>
'&nbsp;&nbsp;&nbsp;&nbsp;Accept: xxx/yyy; zzzz...<BR>
' are entered in this section as<BR>
'&nbsp;&nbsp;&nbsp;&nbsp;xxx/yyy=zzzz...<BR>
' If only the MIME type appears, the form is<BR>
'&nbsp;&nbsp;&nbsp;&nbsp;xxx/yyy=Yes<BR>
'<BR>
' [System]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
&lt;== Windows interface specifics<BR>
' GMT Offset=&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Offset
of local timezone from GMT, seconds (LONG!)<BR>
' Output File=&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Pathname
of file to receive results<BR>
' Content File=&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Pathname
of file containing raw request content<BR>
' Debug Mode=&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;If
server's CGI debug flag is set (Yes/No)<BR>
'<BR>
' [Extra Headers]<BR>
' Any &quot;extra&quot; headers found in the request that activated
this<BR>
' program. They are listed in &quot;key=value&quot; form. Usually,
you'll see<BR>
' at least the name of the browser here as &quot;User-agent&quot;.
<BR>
'<BR>
' [Form Literal]<BR>
' If the request was a POST from a Mosaic form (with content type
of<BR>
' &quot;application/x-www-form-urlencoded&quot;), the server will
decode the<BR>
' form data. Raw form input is of the form &quot;key=value&amp;key=value&amp;...&quot;,