This document discusses CGI programming and HTTP cookies. It provides an overview of CGI and how it is used to send data to servers via the GET and POST methods. It also explains how templates can be used to dynamically generate web pages. Finally, it covers HTTP cookies in detail, including how they are delivered, valid parameters for setting cookies, the different types (persistent and non-persistent), and how they are stored on a user's device.

1. CGI IntroductionCGI Introduction

11. MIME: Multi-Purpose Internet Mail Extensions

18. CGI ProgrammingCGI Programming

19. Simple FormSimple Form

20. Sending Data to the ServerSending Data to the Server

21. The GET MethodThe GET Method
►The GET method sends the encoded userThe GET method sends the encoded user
information appended to url of the pageinformation appended to url of the page
request.request.
►The page and the encoded information areThe page and the encoded information are
separated by theseparated by the ? character.? character.
http://www.test.com/index.htm?name1=value1&name2=value2

22. ►The GET method produces a long stringThe GET method produces a long string
that appears in your server logs, in thethat appears in your server logs, in the
browser's Location: box.browser's Location: box.
►The GET method is restricted to send uptoThe GET method is restricted to send upto
1024 characters only.1024 characters only.
► Never use GET method if you haveNever use GET method if you have
password or other sensitive information topassword or other sensitive information to
be sent to the server.be sent to the server.

23. ►GET can't be used to send binary data, likeGET can't be used to send binary data, like
images or word documents, to the server.images or word documents, to the server.
►The data sent by GET method can beThe data sent by GET method can be
accessed using QUERY_STRINGaccessed using QUERY_STRING
environment variable.environment variable.
►The PHP providesThe PHP provides $_GET associative$_GET associative
array to access all the sentarray to access all the sent
information using GETinformation using GET method.method.

24. The POST MethodThe POST Method
► The POST method transfers information viaThe POST method transfers information via
HTTP headers.HTTP headers.
►The information is encoded as described inThe information is encoded as described in
case of GET method and put into a headercase of GET method and put into a header
called QUERY_STRING.called QUERY_STRING.
► The POST method does not have anyThe POST method does not have any
restriction on data size to be sent.restriction on data size to be sent.
►The POST method can be used to sendThe POST method can be used to send
ASC II as well as binary data.ASC II as well as binary data.

25. ►The data sent by POST method goesThe data sent by POST method goes
through HTTP header so security dependsthrough HTTP header so security depends
on HTTP protocol.on HTTP protocol.
►By using Secure HTTP you can make sureBy using Secure HTTP you can make sure
that your information is secure.that your information is secure.
►The PHP providesThe PHP provides $_POST associative$_POST associative
array to access all the sentarray to access all the sent
information using POSTinformation using POST method.method.

26. Submitting actual DataSubmitting actual Data
When this form is submitted, the browser encodes these
three elements as:
name=Mary+Jones&email=mjones%40jones.com

27. For PostFor Post
► Since the request method is POST in thisSince the request method is POST in this
example,example,
► this string would be added to the HTTP requestthis string would be added to the HTTP request
as the content of that message.as the content of that message.
► The HTTP request message would look like this:The HTTP request message would look like this:
POST /cgi/register.cgi HTTP/1.1
Host: localhost
Content-Length: 67
Content-Type: application/x-www-form-urlencoded
name=Mary+Jones&email=mjones%40jones.com

28. For GETFor GET
►If the request method were set to GET, thenIf the request method were set to GET, then
the request would be formatted this waythe request would be formatted this way
instead:instead:
GET/cgi/register.cgi?name=Mary+Jones&email=mjones%40jones.com
HTTP/1.1
Host: localhost

29. URL-RedirectionURL-Redirection
► Redirect the user to that URLRedirect the user to that URL
redirect($url)

30. URL-Redirection ProgramURL-Redirection Program
► 1: <html>1: <html>
► 2: <head>2: <head>
► 3: <title>Redirect Form</title>3: <title>Redirect Form</title>
► 4: </head>4: </head>
► 5:5:
► 6: <body>6: <body>
► 7:7:
► 8: <form action=”redirect.cgi”>8: <form action=”redirect.cgi”>
► 9: <p>9: <p>
► 10: Go to:10: Go to:
► 11: <select name=”link”>11: <select name=”link”>
► 12: <option value=”http://www.madlyedu.org/medley”>Medley</option>12: <option value=”http://www.madlyedu.org/medley”>Medley</option>
► 13: <option value=”http://www.camworld.com/”>CamWorld</option>13: <option value=”http://www.camworld.com/”>CamWorld</option>
► 14: <option value=”http://www.stuffeddog.com”>The Stuffed Dog</option>14: <option value=”http://www.stuffeddog.com”>The Stuffed Dog</option>
► 15: <option value=”http://www.dangerousmeta.com”>Dangerousmeta!</option>15: <option value=”http://www.dangerousmeta.com”>Dangerousmeta!</option>
► 16: </select>16: </select>
► 17: <input type=”submit” value=”go”>17: <input type=”submit” value=”go”>
► 18: </p>18: </p>
► 19: </form>19: </form>
► 20:20:
► 21: </body>21: </body>
► 22: </html>22: </html>

31. The Site Redirection ScriptThe Site Redirection Script
► 1: #!/usr/local/bin/perl1: #!/usr/local/bin/perl
► 2:2:
► 3: use CGI;3: use CGI;
► 4:4:
► 5: $query = new CGI;5: $query = new CGI;
► 6:6:
► 7: return $query->redirect($query->param(‘link’));7: return $query->redirect($query->param(‘link’));

32. ► A template is a pre-built HTML page.A template is a pre-built HTML page.
► That include integrated images, text contentThat include integrated images, text content
and support files for fonts etc.and support files for fonts etc.
►The end user plugs their information, text andThe end user plugs their information, text and
images, into the pre-built design and thenimages, into the pre-built design and then
uploads to a web hosting account for viewinguploads to a web hosting account for viewing
on the Internet.on the Internet.

33. ► Templates contain following tags:Templates contain following tags:
TMPL_VAR
TMPL_LOOP
TMPL_IF
TMPL_ELSE
TMPL_UNLESS

34. 1.1. <html> (test.tmpl)<html> (test.tmpl)
2.2. <head><head>
3.3. <title>Test Template</title><title>Test Template</title>
4.4. </head></head>
5.5. <body><body>
6.6. My College is <TMPL_VAR NAME=College>My College is <TMPL_VAR NAME=College>
7.7. My City is set to <TMPL_VAR NAME=City>My City is set to <TMPL_VAR NAME=City>
8.8. </body></body>
9.9. </html></html>
#!/usr/bin/perl
use HTML::Template
my $template = HTML::Template->new(filename =>
'test.tmpl');
$template->param(College => ‘GHRCE’);
$template->param(City => ‘Nagpur’);
print "Content-Type: text/htmlnn“;
print $template->output;

35. In the template:In the template:
<TMPL_LOOP NAME=EMPLOYEE_INFO><TMPL_LOOP NAME=EMPLOYEE_INFO>
Name: <TMPL_VAR NAME=NAME>Name: <TMPL_VAR NAME=NAME>
Job: <TMPL_VAR NAME=JOB> <br>Job: <TMPL_VAR NAME=JOB> <br>
</TMPL_LOOP></TMPL_LOOP>
In the script:In the script:
$template->param (EMPLOYEE_INFO => [$template->param (EMPLOYEE_INFO => [
{ name => 'Sam', job => 'programmer' },{ name => 'Sam', job => 'programmer' },
{ name => 'Steve', job => 'student' },{ name => 'Steve', job => 'student' },
]]
););
print $template->output();print $template->output();
The output in a browser:The output in a browser:
Name: Sam Job: programmerName: Sam Job: programmer
Name: Steve Job: studentName: Steve Job: student

36. <TMPL_IF BOOL><TMPL_IF BOOL>
if BOOL is trueif BOOL is true
<TMPL_ELSE><TMPL_ELSE>
if BOOL is falseif BOOL is false
</TMPL_IF></TMPL_IF>
<TMPL_UNLESS BOOL>
if BOOL is FALSE.
<TMPL_ELSE>
if BOOL is TRUE.
</TMPL_UNLESS>
$template->param (BOOL => 1)
$template->param (BOOL => 0)

37. 37
HTTPHTTP CookiesCookies
► HTTP cookiesHTTP cookies, sometimes known as, sometimes known as web cookiesweb cookies oror
justjust cookiescookies, are parcels of text, are parcels of text
 sent by a server to a web browsersent by a server to a web browser
 and then sent backand then sent back unchangedunchanged by the browserby the browser each timeeach time itit
accesses that serveraccesses that server
► HTTPHTTP cookies are used forcookies are used for
 authenticatingauthenticating
 trackingtracking
 maintaining specific information about users, such asmaintaining specific information about users, such as
► site preferencessite preferences
► the contents of their electronic shopping carts.the contents of their electronic shopping carts.

38. 38
Results of RejectingResults of Rejecting HTTPHTTP CookiesCookies
►Most modern browsers allow users to decideMost modern browsers allow users to decide
whether to accept cookieswhether to accept cookies
►However, rejection makes some websitesHowever, rejection makes some websites
unusable.unusable.
 For example,For example, shopping basketsshopping baskets implemented usingimplemented using
cookies do not work if cookies are rejected.cookies do not work if cookies are rejected.

39. 39
Cookie DeliveryCookie Delivery

40. 40
Valid parameters for the cookie() callValid parameters for the cookie() call

41. 41
Types of CookiesTypes of Cookies
►There are two types of cookiesThere are two types of cookies
 persistentpersistent
 non-persistent.non-persistent.

42. 42
Storage of CookieStorage of Cookie
►Only persistent cookies are stored.Only persistent cookies are stored.
 Persistent cookies are stored asPersistent cookies are stored as text filestext files..
 Persistent cookies are stored in the hard diskPersistent cookies are stored in the hard disk
of the user as text files.of the user as text files.
►Non-persistent are stored in the memory.Non-persistent are stored in the memory.
 They vanish when the browser windows isThey vanish when the browser windows is
closed.closed.

43. 43
Non-Persistent and PersistentNon-Persistent and Persistent
CookiesCookies
►If theIf the cookie setter does not specify a
date, the cookie is removed once the user, the cookie is removed once the user
quits his browser c/a Non-Persistentquits his browser c/a Non-Persistent
►Cookies with an expiration date are calledCookies with an expiration date are called
persistent.
►Specifying a date is a way for making aSpecifying a date is a way for making a
cookie survive acrosscookie survive across sessionssessions..

44. 44
domain=DOMAIN_NAME
► When searching the cookie list for valid cookies, a
comparison of the domain attributes of the cookie is
made with the Internet domain name of the host from
which the URL will be fetched.
► If there is a tail match, then the cookie will go through path
matching to see if it should be sent.
 "Tail matching" means A domain attribute of "acme.com" would
match host names "anvil.acme.com" as well as
"shipping.crate.acme.com".

45. 45
path=PATH
If a cookie has already passedIf a cookie has already passed domaindomain matching, thenmatching, then
thethe path-name component of the URL is comparedpath-name component of the URL is compared
with the path attributewith the path attribute,, andand if there is a match, the, the
cookie is considered valid and is sentcookie is considered valid and is sent along with thealong with the
URLURL request.request.

46. 46
Examples (2)Examples (2)

47. 47
Examine the CookiesExamine the Cookies
► Most browsers supportingMost browsers supporting JavaScriptJavaScript allow theallow the
user to see the cookies that are active with respectuser to see the cookies that are active with respect
to a given page by typingto a given page by typing
javascript:alert("Cookies: "+document.cookie)javascript:alert("Cookies: "+document.cookie) in thein the
browserbrowser URLURL field.field.
► Some browsers incorporate aSome browsers incorporate a cookie managercookie manager
for the user to see and selectively delete thefor the user to see and selectively delete the
cookies currently stored in the browser.cookies currently stored in the browser.

48. 48
Drawbacks of CookiesDrawbacks of Cookies
► Besides privacy concerns, there are some otherBesides privacy concerns, there are some other
reasons why cookies have been opposed:reasons why cookies have been opposed:
 they can be used forthey can be used for security attackssecurity attacks..
► Cookie theftCookie theft
► Cookie poisoningCookie poisoning
► Cross-site cooking (Value sent to host controlled by hakers)Cross-site cooking (Value sent to host controlled by hakers)

49. 49
Example of an HTTP Response fromExample of an HTTP Response from
google.comgoogle.com

50. Various operations on CookiesVarious operations on Cookies
To set cookies:To set cookies:
$cookie = $query->cookie(-name=>’menus’,-value=>’on’,$cookie = $query->cookie(-name=>’menus’,-value=>’on’,
-expires=>’+30d’, -path=>’/’);-expires=>’+30d’, -path=>’/’);
To print header:To print header:
print $query->header(-cookie=>$cookie);print $query->header(-cookie=>$cookie);
To fetch the names of all the cookies:To fetch the names of all the cookies:
$query->cookie();$query->cookie();
To fetch the value of a single cookie:To fetch the value of a single cookie:
$query->cookie(‘menu’);$query->cookie(‘menu’);

51. CGI SecurityCGI Security
► CGI scripts can present security holes in twoCGI scripts can present security holes in two
ways:ways:
1.1. They mayThey may intentionally or unintentionally leak
information about the host system.about the host system.
2.2. Scripts that process remote user input, such as the contentsScripts that process remote user input, such as the contents
of a form may be vulnerable to attacks inof a form may be vulnerable to attacks in

52. CGI SecurityCGI Security
► Security holes present in CGI can be exploited for various
purposes:
1. Critical files, particularly those which contain sensitive
information (such as passwords), are stolen, modified or erased
by unauthorized users.
2. Content is sold to a competitor.
3. Information about the host machine is obtained which will allow
unauthorized users to have access to the system.
4. Commands are executed on the server host machine, allowing
unauthorized users to modify the system.
5. The site is used to launch attacks against other sites.

53. Common CGI SecurityCommon CGI Security
HolesHoles
► The Buffer Overflow Problem:The Buffer Overflow Problem:
 An attacker can send a lot more data thanAn attacker can send a lot more data than
you planned for and crash the program.you planned for and crash the program.
 sometimes get access to your system.sometimes get access to your system.

54. Using File PathsUsing File Paths
► If you enable users to enter the any path information, soIf you enable users to enter the any path information, so
user can enter paths to any file on the server.user can enter paths to any file on the server.
► If the user entered the path “../../etc/passwd”, a poorlyIf the user entered the path “../../etc/passwd”, a poorly
written script would send the password file to the user.written script would send the password file to the user.
► We should always check to make sure that ..We should always check to make sure that ..
expressions haven’t been slipped into the path.expressions haven’t been slipped into the path.

55. Don’t Place the PerlDon’t Place the Perl
Interpreter in cgi-binInterpreter in cgi-bin
► If user managed to get access to your server,so cgi-bin
will be default directory for him.
► Placing the Perl executable in the cgi-bin directory
enables any user to run arbitrary Perl code on the
server.
► User could enter URL to delete all the files in the
server’s directory:
/cgi-bin/perl.exe?&-e+unlink+%3C*%3E

56. Keep Your ServerKeep Your Server
Information PrivateInformation Private
► The more information about your server that you giveThe more information about your server that you give
out, the easier it is for crackers to break into yourout, the easier it is for crackers to break into your
system.system.

57. ►Thank You……..Thank You……..