ch7.htm

CGI programming is the hottest stuff to look out for in this book

<TT><FONT FACE="Courier">if ($email =~ /[^a-zA-Z0-9_\-\.@]/) {
<BR>
</FONT></TT>
</BLOCKQUOTE>
<P>
<CENTER><TABLE BORDERCOLOR=#000000 BORDER=1 WIDTH=80%>
<TR><TD><B>Warning</B></TD></TR>
<TR><TD>
<BLOCKQUOTE>
Be very careful when you create a script that passes arguments to other programs or issues shell commands! If the input were not verified for illegal e-mail addresses, a cracker could easily exploit this hole. A cracker could, for example, send the file 
containing the list of users' passwords on the server to his or her own mailbox, by introducing the e-mail <TT><FONT FACE="Courier">something ; mail [e-mail] &lt; /etc/passwd</FONT></TT>! Or, even worse, the cracker could delete some files belonging 
to the user that runs the Web server if he or she used the <TT><FONT FACE="Courier">rm</FONT></TT> (remove file) command instead of the <TT><FONT FACE="Courier">mail</FONT></TT> command! The golden rule is: Always verify user's input and allow only what is 
strictly necessary.
</BLOCKQUOTE>

</TD></TR>
</TABLE></CENTER>
<P>
<H3><A NAME="FormbyMail">Form-by-Mail</A></H3>
<P>
The gateway presented in Listing 7.4 acts as an intermediary between
the Web server and a mail program. It is useful for sending form
results by e-mail. One of the uses for this, for example, is a
comments page in which users visiting your Web pages can leave
their comments or questions.
<P>
This script should be called from the form page with the <TT><FONT FACE="Courier">POST</FONT></TT>
method:
<BLOCKQUOTE>
<TT><FONT FACE="Courier">&lt;FORM ACTION=&quot;/cgi-bin/mailform?user@server?subject&quot;
METHOD=post&gt;</FONT></TT>
</BLOCKQUOTE>
<P>
The e-mail address where the form should be sent to is specified
in <TT><FONT FACE="Courier">user@server</FONT></TT>, and the subject
should go just after it. Both arguments are separated by a <TT><FONT FACE="Courier">?</FONT></TT>
sign. If the form has a field called <TT><FONT FACE="Courier">email</FONT></TT>,
the script will send the form results with the <TT><FONT FACE="Courier">From:</FONT></TT>
and <TT><FONT FACE="Courier">Reply-To:</FONT></TT> lines containing
the correct e-mail address, so you can use the reply function
of your mail reader program to answer the user's questions. If
there is no field called <TT><FONT FACE="Courier">email</FONT></TT>
on the form, the script will send the mail as if it came from
the user who runs the Web server (usually <TT><FONT FACE="Courier">nobody</FONT></TT>
or <TT><FONT FACE="Courier">webmaster</FONT></TT>). See Figure
7.5 for an example of an HTML form that uses the mailform script.
<P>
<A HREF="f7-5.gif" ><B>Figure 7.5:</B> <I>The HTML source of a form page.</I></A>
<HR>
<BLOCKQUOTE>
<B>Listing 7.4. A form-by-mail script called mailform.<BR>
</B>
</BLOCKQUOTE>
<BLOCKQUOTE>
<TT><FONT FACE="Courier">#!/usr/bin/perl<BR>
###########################################################################
<BR>
# mailform.pl 1.0 - A simple form-by-mail script&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#
<BR>
#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
#<BR>
# How does it 
work?&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp
;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
#<BR>
# It gets data from an HTML form and sends all the field values
to the&nbsp;&nbsp;&nbsp;&nbsp;#<BR>
# address specified as the first parameter of the script.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
#<BR>
#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
#<BR>
# Special field on form named &quot;email&quot; is used for the
Reply-To header.&nbsp;&nbsp;&nbsp;&nbsp;#<BR>
#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
#<BR>
# Antonio 
Ferreira&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&n
bsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#
<BR>
# 
[e-mail]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp
;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
#<BR>
#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
#<BR>
# March 
1996&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#
<BR>
###########################################################################
<BR>
<BR>
require '/usr/lib/cgi-lib.pl';&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#
The useful cgi-lib<BR>
<BR>
######################### Variable initialization ########################
<BR>
<BR>
##### Paths, binaries and system specific information #####<BR>
$url = 'http://www.esoterica.pt/cgi-bin/mailform.pl';&nbsp;&nbsp;&nbsp;&nbsp;#
mailform URL<BR>
$sendmail = '/usr/bin/smail';&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#
Path and parameters for the mailer<BR>
$mailserver = 'mail.esoterica.pt';&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#
Complete mail server hostname<BR>
<BR>
########################## Start of Main Program ##########################
<BR>
<BR>
&amp;ReadParse(*input);&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#
cgi-lib, constructs list of key=value form data<BR>
print &amp;PrintHeader();&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#
cgi-lib, prints header &quot;Content-type: text/html\n\n&quot;
<BR>
<BR>
($destaddr, $subject, $garbage) = split(/\?/i, $ENV{'QUERY_STRING'});
<BR>
if (&amp;MethGet()) {<BR>
&nbsp;&nbsp;&nbsp;&nbsp;print &lt;&lt;EOM;<BR>
&lt;HTML&gt;<BR>
&lt;HEAD&gt;<BR>
&lt;TITLE&gt;Message not sent&lt;/TITLE&gt;<BR>
&lt;/HEAD&gt;<BR>
&lt;BODY&gt;<BR>
The message should be sent with the &lt;B&gt;POST&lt;/B&gt; method!
<BR>
&lt;/BODY&gt;<BR>
&lt;/HTML&gt;<BR>
EOM<BR>
} else {<BR>
&nbsp;&nbsp;&nbsp;&nbsp;if ($destaddr eq '') {<BR>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;print &lt;&lt;EOM;
<BR>
&lt;HTML&gt;<BR>
&lt;HEAD&gt;<BR>
&lt;TITLE&gt;Message not sent&lt;/TITLE&gt;<BR>
&lt;/HEAD&gt;<BR>
&lt;BODY&gt;<BR>
The message did not have a destination address.<BR>
&lt;/BODY&gt;<BR>
&lt;/HTML&gt;<BR>
EOM<BR>
&nbsp;&nbsp;&nbsp;&nbsp;} else {<BR>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&amp;SendForm();
<BR>
&nbsp;&nbsp;&nbsp;&nbsp;}<BR>
}<BR>
<BR>
exit(0);<BR>
<BR>
########################## End of Main Program ##########################
<BR>
<BR>
#################### Start of subroutines definitions ###################
<BR>
<BR>
##### Uses the mailer defined to send the reply #####<BR>
sub SendForm {<BR>
&nbsp;&nbsp;&nbsp;&nbsp;$fromurl = $ENV{'HTTP_REFERER'};<BR>
&nbsp;&nbsp;&nbsp;&nbsp;$fromhost = $ENV{'REMOTE_HOST'};<BR>
&nbsp;&nbsp;&nbsp;&nbsp;if ($subject eq '') {<BR>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$subject = $fromurl;
<BR>
&nbsp;&nbsp;&nbsp;&nbsp;}<BR>
&nbsp;&nbsp;&nbsp;&nbsp;if ($input{'email'} eq '') {<BR>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$fromaddr = 'www';
<BR>
&nbsp;&nbsp;&nbsp;&nbsp;} else {<BR>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$fromaddr = $input{'email'};
<BR>
&nbsp;&nbsp;&nbsp;&nbsp;}<BR>
&nbsp;&nbsp;&nbsp;&nbsp;open(MAIL,&quot;| $sendmail \&quot;$destaddr\&quot;&quot;);
<BR>
&nbsp;&nbsp;&nbsp;&nbsp;print MAIL &lt;&lt;EOM;<BR>
From: $fromaddr<BR>
To: $destaddr<BR>
Reply-To: $fromaddr<BR>
Subject: $subject<BR>
X-Mail-Program: Mailform<BR>
<BR>
URL: $fromurl<BR>
SERVIDOR: $fromhost<BR>
<BR>
EOM<BR>
&nbsp;&nbsp;&nbsp;&nbsp;foreach $field (@input) {<BR>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$_ = $field;<BR>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;($name) = /^(.+)\=.*$/;
<BR>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;print MAIL &quot;-=-=-
$name -=-=-\n&quot;;<BR>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;print MAIL &quot;$input{$name}\n&quot;;
<BR>
&nbsp;&nbsp;&nbsp;&nbsp;}<BR>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;close(MAIL);
<BR>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;print
&lt;&lt;EOM;<BR>
&lt;HTML&gt;<BR>
&lt;HEAD&gt;<BR>
&lt;TITLE&gt;Message sent&lt;/TITLE&gt;<BR>
&lt;/HEAD&gt;<BR>
&lt;BODY&gt;<BR>
&lt;H2 ALIGN=center&gt;Your message was sent to $destaddr!&lt;/H2&gt;
<BR>
&lt;/BODY&gt;<BR>
&lt;/HTML&gt;<BR>
EOM<BR>
}</FONT></TT>
</BLOCKQUOTE>
<HR>
<P>
The HTML source presented in Figure 7.5 corresponds to the FORM
in Figure 7.6. This figure shows what the user sees in his or
her browser.
<P>
<A HREF="f7-6.gif" ><B>Figure 7.6:</B> <I>The form that will be sent by mail.</I></A>
<P>
When the user presses the button Send It, the form will be sent
by mail and will arrive to its destination mailbox. The received
mail message will be similar to the one presented in Figure 7.7.
<P>
<A HREF="f7-7.gif" ><B>Figure 7.7:</B> <I>The message that arrived in the mailbox.</I></A><I>.</I>
<P>
Lots of other examples could be given here, but we'll let you
explore further. There are many gateways out there waiting for
you to improve them: finger, wais, archie, uptime, passwd, mail,
news, and so on. Explore the programs or protocols first and then
modify the corresponding gateways to suit your needs.
<H2><A NAME="UsingtheWebasaStandardInternetAcc"><FONT SIZE=5 COLOR=#FF0000>Using
the Web as a Standard Internet Access Interface</FONT></A></H2>
<P>
When I first became familiar with the Web and then with CGI and
gateways, I started thinking to myself: &quot;Wow, the Web is
great, and I'll use it to do everything I have ever dreamed of
doing on the Internet!&quot; Yes and No. The Web is really great,
and it is actually the most suited platform to integrate most
of Internet services or functions. But there are some protocols
that simply cannot be integrated in Web pages through the use
of gateways or similar mechanisms due to their original design,
which is incompatible with the Web.
<P>
One such example is the telnet protocol. This protocol is highly
interactive and does not fit within the client/server connect-and-send-on-demand
architecture of the HTTP protocol and the Web. During a telnet
connection, the user screen and the telnet server must be connected
without interruption so the user can type characters on the keyboard
and immediately see results on the screen. How could that be done
in a Web page? We could imagine a Web page that would be reloaded
each time the user presses a key or each time there are results
coming from the telnet server, but that would be practically impossible
to accomplish due to performance considerations and design difficulties
on the server side. What is possible is the integration of a telnet
capable program within a Web browser so that we can telnet from
a Web page. But that would be more a telnet screen than a Web
page.
<P>
Another example is the Ping protocol. This is used to test if
a machine is alive and well. The client sends packets of bits,
and the server replies as soon as it receives these packets. Generally,
Ping programs send and receive packets until we stop them deliberately,
which causes a problem because a result HTML page can be produced
only when program activity (in this case, Ping activity) finishes
with no user intervention. So, one must use a Ping program that
sends and receives a fixed number of packets and, as soon as it
finishes, sends results back to be displayed in an HTML page.
<P>
Fortunately, many other protocols can be integrated through the
use of a gateway. For example, there are mail and news gateways
that allow reading of mail and news, respectively, as well as
database gateways that allow querying from a Web page.
<P>
The World Wide Web is evolving as the most powerful, cross-platform,
independent, distributed, and hypermedia mechanism for information
retrieval. Gateways can only help the Web expand even more in
order to become <I>the</I> platform for Internet access. Stay
tuned!
<H2><A NAME="Summary"><FONT SIZE=5 COLOR=#FF0000>Summary</FONT></A>
</H2>
<P>
This chapter covered server-side includes and World-Wide Web gateways.
Both mechanisms help you extend your Web server functionality
and consequently improve the richness of the information you want
to show to other users. You have learned how to use both SSI and
gateways and how to develop custom solutions for your own use.
<P>
<HR WIDTH="100%"></P>

<CENTER><P><A HREF="ch6.htm"><IMG SRC="pc.gif" BORDER=0 HEIGHT=88 WIDTH=140></A><A HREF="#CONTENTS"><IMG SRC="cc.gif" BORDER=0 HEIGHT=88 WIDTH=140></A><A HREF="index.htm"><IMG SRC="hb.gif" BORDER=0 HEIGHT=88 WIDTH=140></A><A HREF="ch8.htm"><IMG 
SRC="nc.gif" BORDER=0 HEIGHT=88 WIDTH=140></A></P></CENTER>

<P>
<HR WIDTH="100%"></P>

</BODY>
</HTML>