|
CGI - Simple Common Gateway Interface Class
use CGI qw/:standard/;
print header,
start_html('A Simple Example'),
h1('A Simple Example'),
start_form,
"What's your name? ",textfield('name'),p,
"What's the combination?", p,
checkbox_group(-name=>'words',
-values=>['eenie','meenie','minie','moe'],
-defaults=>['eenie','minie']), p,
"What's your favorite color? ",
popup_menu(-name=>'color',
-values=>['red','green','blue','chartreuse']),p,
submit,
end_form,
hr;
if (param()) {
my $name = param('name');
my $keywords = join ', ',param('words');
my $color = param('color');
print "Your name is",em(escapeHTML($name)),p,
"The keywords are: ",em(escapeHTML($keywords)),p,
"Your favorite color is ",em(escapeHTML($color)),
hr;
}
This perl library uses perl5 objects to make it easy to create Web
fill-out forms and parse their contents. This package defines CGI
objects, entities that contain the values of the current query string
and other state variables. Using a CGI object's methods, you can
examine keywords and parameters passed to your script, and create
forms whose initial values are taken from the current query (thereby
preserving state information). The module provides shortcut functions
that produce boilerplate HTML, reducing typing and coding errors. It
also provides functionality for some of the more advanced features of
CGI scripting, including support for file uploads, cookies, cascading
style sheets, server push, and frames.
CGI.pm also provides a simple function-oriented programming style for
those who don't need its object-oriented features.
The current version of CGI.pm is available at
http://www.genome.wi.mit.edu/ftp/pub/software/WWW/cgi_docs.html
ftp://ftp-genome.wi.mit.edu/pub/software/WWW/
There are two styles of programming with CGI.pm, an object-oriented
style and a function-oriented style. In the object-oriented style you
create one or more CGI objects and then use object methods to create
the various elements of the page. Each CGI object starts out with the
list of named parameters that were passed to your CGI script by the
server. You can modify the objects, save them to a file or database
and recreate them. Because each object corresponds to the "state" of
the CGI script, and because each object's parameter list is
independent of the others, this allows you to save the state of the
script and restore it later.
For example, using the object oriented style, here is how you create
a simple "Hello World" HTML page:
use CGI;
$q = new CGI;
print $q->header,
$q->start_html('hello world'),
$q->h1('hello world'),
$q->end_html;
In the function-oriented style, there is one default CGI object that
you rarely deal with directly. Instead you just call functions to
retrieve CGI parameters, create HTML tags, manage cookies, and so
on. This provides you with a cleaner programming interface, but
limits you to using one CGI object at a time. The following example
prints the same page, but uses the function-oriented interface.
The main differences are that we now need to import a set of functions
into our name space (usually the "standard" functions), and we don't
need to create the CGI object.
use CGI qw/:standard/;
print header,
start_html('hello world'),
h1('hello world'),
end_html;
The examples in this document mainly use the object-oriented style.
See HOW TO IMPORT FUNCTIONS for important information on
function-oriented programming in CGI.pm
Most CGI.pm routines accept several arguments, sometimes as many as 20
optional ones! To simplify this interface, all routines use a named
argument calling style that looks like this:
print $q->header(-type=>'image/gif',-expires=>'+3d');
Each argument name is preceded by a dash. Neither case nor order
matters in the argument list. -type, -Type, and -TYPE are all
acceptable. In fact, only the first argument needs to begin with a
dash. If a dash is present in the first argument, CGI.pm assumes
dashes for the subsequent ones.
Several routines are commonly called with just one argument. In the
case of these routines you can provide the single argument without an
argument name. header() happens to be one of these routines. In this
case, the single argument is the document type.
print $q->header('text/html');
Other such routines are documented below.
Sometimes named arguments expect a scalar, sometimes a reference to an
array, and sometimes a reference to a hash. Often, you can pass any
type of argument and the routine will do whatever is most appropriate.
For example, the param() routine is used to set a CGI parameter to a
single or a multi-valued value. The two cases are shown below:
$q->param(-name=>'veggie',-value=>'tomato');
$q->param(-name=>'veggie',-value=>['tomato','tomahto','potato','potahto']);
A large number of routines in CGI.pm actually aren't specifically
defined in the module, but are generated automatically as needed.
These are the "HTML shortcuts," routines that generate HTML tags for
use in dynamically-generated pages. HTML tags have both attributes
(the attribute="value" pairs within the tag itself) and contents (the
part between the opening and closing pairs.) To distinguish between
attributes and contents, CGI.pm uses the convention of passing HTML
attributes as a hash reference as the first argument, and the
contents, if any, as any subsequent arguments. It works out like
this:
Code Generated HTML
---- --------------
h1() <h1>
h1('some','contents'); <h1>some contents</h1>
h1({-align=>left}); <h1 align="LEFT">
h1({-align=>left},'contents'); <h1 align="LEFT">contents</h1>
HTML tags are described in more detail later.
Many newcomers to CGI.pm are puzzled by the difference between the
calling conventions for the HTML shortcuts, which require curly braces
around the HTML tag attributes, and the calling conventions for other
routines, which manage to generate attributes without the curly
brackets. Don't be confused. As a convenience the curly braces are
optional in all but the HTML shortcuts. If you like, you can use
curly braces when calling any routine that takes named arguments. For
example:
print $q->header( {-type=>'image/gif',-expires=>'+3d'} );
If you use the -w switch, you will be warned that some CGI.pm argument
names conflict with built-in Perl functions. The most frequent of
these is the -values argument, used to create multi-valued menus,
radio button clusters and the like. To get around this warning, you
have several choices:
-
Use another name for the argument, if one is available.
For example, -value is an alias for -values.
-
Change the capitalization, e.g. -Values
-
Put quotes around the argument name, e.g. '-values'
Many routines will do something useful with a named argument that it
doesn't recognize. For example, you can produce non-standard HTTP
header fields by providing them as named arguments:
print $q->header(-type => 'text/html',
-cost => 'Three smackers',
-annoyance_level => 'high',
-complaints_to => 'bit bucket');
This will produce the following nonstandard HTTP header:
HTTP/1.0 200 OK
Cost: Three smackers
Annoyance-level: high
Complaints-to: bit bucket
Content-type: text/html
Notice the way that underscores are translated automatically into
hyphens. HTML-generating routines perform a different type of
translation.
This feature allows you to keep up with the rapidly changing HTTP and
HTML "standards".
$query = new CGI;
This will parse the input (from both POST and GET methods) and store
it into a perl5 object called $query.
Any filehandles from file uploads will have their position reset to
the beginning of the file.
$query = new CGI(INPUTFILE);
If you provide a file handle to the new() method, it will read
parameters from the file (or STDIN, or whatever). The file can be in
any of the forms describing below under debugging (i.e. a series of
newline delimited TAG=VALUE pairs will work). Conveniently, this type
of file is created by the save() method (see below). Multiple records
can be saved and restored.
Perl purists will be pleased to know that this syntax accepts
references to file handles, or even references to filehandle globs,
which is the "official" way to pass a filehandle:
$query = new CGI(\*STDIN);
You can also initialize the CGI object with a FileHandle or IO::File
object.
If you are using the function-oriented interface and want to
initialize CGI state from a file handle, the way to do this is with
restore_parameters(). This will (re)initialize the
default CGI object from the indicated file handle.
open (IN,"test.in") || die;
restore_parameters(IN);
close IN;
You can also initialize the query object from an associative array
reference:
$query = new CGI( {'dinosaur'=>'barney',
'song'=>'I love you',
'friends'=>[qw/Jessica George Nancy/]}
);
or from a properly formatted, URL-escaped query string:
$query = new CGI('dinosaur=barney&color=purple');
or from a previously existing CGI object (currently this clones the
parameter list, but none of the other object-specific fields, such as
autoescaping):
$old_query = new CGI;
$new_query = new CGI($old_query);
To create an empty query, initialize it from an empty string or hash:
$empty_query = new CGI("");
-or-
$empty_query = new CGI({});
@keywords = $query->keywords
If the script was invoked as the result of an <ISINDEX> search, the
parsed keywords can be obtained as an array using the keywords() method.
@names = $query->param
If the script was invoked with a parameter list
(e.g. "name1=value1&name2=value2&name3=value3"), the param() method
will return the parameter names as a list. If the script was invoked
as an <ISINDEX> script and contains a string without ampersands
(e.g. "value1+value2+value3") , there will be a single parameter named
"keywords" containing the "+"-delimited keywords.
NOTE: As of version 1.5, the array of parameter names returned will
be in the same order as they were submitted by the browser.
Usually this order is the same as the order in which the
parameters are defined in the form (however, this isn't part
of the spec, and so isn't guaranteed).
@values = $query->param('foo');
-or-
$value = $query->param('foo');
Pass the param() method a single argument to fetch the value of the
named parameter. If the parameter is multivalued (e.g. from multiple
selections in a scrolling list), you can ask to receive an array. Otherwise
the method will return a single value.
If a value is not given in the query string, as in the queries
"name1=&name2=" or "name1&name2", it will be returned as an empty
string. This feature is new in 2.63.
If the parameter does not exist at all, then param() will return undef
in a scalar context, and the empty list in a list context.
$query->param('foo','an','array','of','values');
This sets the value for the named parameter 'foo' to an array of
values. This is one way to change the value of a field AFTER
the script has been invoked once before. (Another way is with
the -override parameter accepted by all methods that generate
form elements.)
param() also recognizes a named parameter style of calling described
in more detail later:
$query->param(-name=>'foo',-values=>['an','array','of','values']);
-or-
$query->param(-name=>'foo',-value=>'the value');
$query->append(-name=>'foo',-values=>['yet','more','values']);
This adds a value or list of values to the named parameter. The
values are appended to the end of the parameter if it already exists.
Otherwise the parameter is created. Note that this method only
recognizes the named argument calling syntax.
$query->import_names('R');
This creates a series of variables in the 'R' namespace. For example,
$R::foo, @R:foo. For keyword lists, a variable @R::keywords will appear.
If no namespace is given, this method will assume 'Q'.
WARNING: don't import anything into 'main'; this is a major security
risk!!!!
NOTE 1: Variable names are transformed as necessary into legal Perl
variable names. All non-legal characters are transformed into
underscores. If you need to keep the original names, you should use
the param() method instead to access CGI variables by name.
NOTE 2: In older versions, this method was called import(). As of version 2.20,
this name has been removed completely to avoid conflict with the built-in
Perl module import operator.
$query->delete('foo','bar','baz');
This completely clears a list of parameters. It sometimes useful for
resetting parameters that you don't want passed down between script
invocations.
If you are using the function call interface, use "Delete()" instead
to avoid conflicts with Perl's built-in delete operator.
$query->delete_all();
This clears the CGI object completely. It might be useful to ensure
that all the defaults are taken when you create a fill-out form.
Use Delete_all() instead if you are using the function call interface.
If POSTed data is not of type application/x-www-form-urlencoded or
multipart/form-data, then the POSTed data will not be processed, but
instead be returned as-is in a parameter named POSTDATA. To retrieve
it, use code like this:
my $data = $query->param('POSTDATA');
(If you don't know what the preceding means, don't worry about it. It
only affects people trying to use CGI for XML processing and other
specialized tasks.)
$q->param_fetch('address')->[1] = '1313 Mockingbird Lane';
unshift @{$q->param_fetch(-name=>'address')},'George Munster';
If you need access to the parameter list in a way that isn't covered
by the methods above, you can obtain a direct reference to it by
calling the param_fetch() method with the name of the . This
will return an array reference to the named parameters, which you then
can manipulate in any way you like.
You can also use a named argument style using the -name argument.
$params = $q->Vars;
print $params->{'address'};
@foo = split("\0",$params->{'foo'});
%params = $q->Vars;
use CGI ':cgi-lib';
$params = Vars;
Many people want to fetch the entire parameter list as a hash in which
the keys are the names of the CGI parameters, and the values are the
parameters' values. The Vars() method does this. Called in a scalar
context, it returns the parameter list as a tied hash reference.
Changing a key changes the value of the parameter in the underlying
CGI parameter list. Called in a list context, it returns the
parameter list as an ordinary hash. This allows you to read the
contents of the parameter list, but not to change it.
When using this, the thing you must watch out for are multivalued CGI
parameters. Because a hash cannot distinguish between scalar and
list context, multivalued parameters will be returned as a packed
string, separated by the "\0" (null) character. You must split this
packed string in order to get at the individual values. This is the
convention introduced long ago by Steve Brenner in his cgi-lib.pl
module for Perl version 4.
If you wish to use Vars() as a function, import the :cgi-lib set of
function calls (also see the section on CGI-LIB compatibility).
$query->save(\*FILEHANDLE)
This will write the current state of the form to the provided
filehandle. You can read it back in by providing a filehandle
to the new() method. Note that the filehandle can be a file, a pipe,
or whatever!
The format of the saved file is:
NAME1=VALUE1
NAME1=VALUE1'
NAME2=VALUE2
NAME3=VALUE3
=
Both name and value are URL escaped. Multi-valued CGI parameters are
represented as repeated names. A session record is delimited by a
single = symbol. You can write out multiple records and read them
back in with several calls to new. You can do this across several
sessions by opening the file in append mode, allowing you to create
primitive guest books, or to keep a history of users' queries. Here's
a short example of creating multiple session records:
use CGI;
open (OUT,">>test.out") || die;
$records = 5;
foreach (0..$records) {
my $q = new CGI;
$q->param(-name=>'counter',-value=>$_);
$q->save(\*OUT);
}
close OUT;
open (IN,"test.out") || die;
while (!eof(IN)) {
my $q = new CGI(\*IN);
print $q->param('counter'),"\n";
}
The file format used for save/restore is identical to that used by the
Whitehead Genome Center's data exchange format "Boulderio", and can be
manipulated and even databased using Boulderio utilities. See
http://stein.cshl.org/boulder/
for further details.
If you wish to use this method from the function-oriented (non-OO)
interface, the exported name for this method is save_parameters().
Errors can occur while processing user input, particularly when
processing uploaded files. When these errors occur, CGI will stop
processing and return an empty parameter list. You can test for
the existence and nature of errors using the cgi_error() function.
The error messages are formatted as HTTP status codes. You can either
incorporate the error text into an HTML page, or use it as the value
of the HTTP status:
my $error = $q->cgi_error;
if ($error) {
print $q->header(-status=>$error),
$q->start_html('Problems'),
$q->h2('Request not processed'),
$q->strong($error);
exit 0;
}
When using the function-oriented interface (see the next section),
errors may only occur the first time you call param(). Be ready
for this!
To use the function-oriented interface, you must specify which CGI.pm
routines or sets of routines | 
