In the example, there is no path information, so the query string begins immediately after the target URI, nph-get_method.cgi, is identified.

Name/Value Pairs

All the data input from a form is sent to the server or your CGI program as name/value pairs. In the registration example, you only used text input, but even the Submit button is sent as a name/value pair. You can see this on line 33 in Listing 4.5. <td width=50%> <input type="submit" name="simple" value=" Submit Registration " >

The Submit button name is simple and the value is Submit Registration. Notice that case is maintained in the Value fields.

Name/value pairs always are passed to the server as name=value, and each new pair is separated by the ampersand (&), as this example shows: name1=value1&name2=value2

This arrangement lets you perform some simple data decoding and have a variable=value already built for your Bourne or C-shell script to use. Using Perl, you can separate name/value pairs with just a little bit of effort. Input decoding is covered in Chapter 5.

Notice on line 16 of Listing 4.5 that the Name attribute is added to the Input type of text: <input type=text size=10 maxlength=20 name="first" >

If you are familiar with programming, name is the formal parameter declaration; the value, whether given by default or by entering data into the entry field, is the actual parameter definition.

Put into other words, the name is your program's way of always referring to the incoming data. The Name field never changes. The data associated with the Name field is in the value portion of the name/value pair. The Value field changes with every new submittal. In the sample first=Eric name/value pair, the name is first and the value is Eric.

Just remember that whether you use text-entry fields, radio buttons, checkboxes, or pull-down menus, everything entered on your Web page form is sent as name/value pairs.

Path Information

Path information can be added to the Action string identifying your CGI program. You can use path information to give variable information to your CGI program. Suppose that you have several forms that call the same CGI program. The CGI program can access several databases, depending on which form was submitted.

One way to tell your CGI program which database to access is to include the path to the correct database in the form submittal.

You add path information in the Action field of the opening HTML Form tag.

First, you identify your CGI program by putting into the Action field the path to your CGI program and then the program name itself-for example, <FORM METHOD=GET ACTION="/cgi-bin/database.cgi/">

Next, you add any additional path information you want to give your CGI program. So, if you want to add path information to one of three databases in the earlier URI, your code will look like this: <FORM METHOD=GET ACTION="/cgi-bin/database.cgi/database2/">

The path information in this example is database2/.

After the Submit button is clicked, the browser appends a question mark (?) onto the Action URI; then the name/value pairs are appended after the question mark.

Using URI Encoding

By now, you have figured out that in order to send your data from the browser to the server, some type of data encoding must have occurred. This is called URI encoding ; I use this term because, as discussed in Chapter 1 URL and URI are synonymous and the ncSA gurus use URI in their standards documents.

The convention of URI encoding Internet data was started in order to handle sending URIs by electronic mail. Part of the encoding sequence is for special characters like tab, space, and the quotation mark. E-mail tools have problems with these and other special characters in the ASCII character set. Next, the URI gets really confused if you used the reserved HTML characters within a URI. So, if the URI you're referencing includes restricted characters like spaces, they must be encoded into the hexadecimal equivalent.

So why do you care about URI encoding, other than the fact that I have been talking about it throughout this chapter? Well, for two reasons:

• Several reserved characters must be URI encoded if you include them in your URI string in the Action field or any other field sent to your CGI program. Spaces, the percent sign (%), and the question mark (?) are all good examples of special characters. These are covered next.
• All data is URI encoded, and if you're going to be able to decode it when it gets to your CGI program, you must understand it.

Reserved Characters

So what is this set of characters that cannot be included in your URI? One of the simple characters is the space character. If you own a Macintosh, spaces in filenames are a common and convenient feature of the Apple operating system. When shipped on the Net, however, they confuse things. If you have a filename called Race Cars, for example, you need to encode that into Race%20Cars.

The percent sign (%) tells the decoding routine that encoding has begun. The next two characters are hexadecimal numbers that correspond to the ASCII equivalent value of space.

If you want to send HTML tags as part of your data transfer, the < and > tags need to be encoded. They encode as %3C for < and %3E for >.

Table 4.3 lists the ASCII characters that must be encoded in your URI. It shows the decimal and the hexadecimal values. The decimal values are included only for information. They cannot be used as encoding values; you must use the hexadecimal values in order to URI encode these characters.

In addition to the reserved characters listed here, several other characters should be encoded if you don't want them to be interpreted by your server or client for their special meanings:

• The question mark (?) encodes as %3F; otherwise, you will begin a query string too early.
• The ampersand (&) encodes as %26; otherwise, you start the separation of a name/value pair when you don't want to.
• The slash (/) encodes as %2F; otherwise, you will start a new directory path.
• The equal sign (=) encodes as %3D; otherwise, you might bind a name/value pair when you don't want to.
• The number sign (#) encodes as %23. This is used to reference another location in the same document.
• The percent sign (%) encodes as %25; otherwise, you really will confuse everyone. Decoding will start at your unencoded %.

If you want to look at the gory details of MIME/URI encoding, you can get RFC 1552, the MIME message header extensions document, off the Net. It has the encoding format in Section 3 and is available with the other Internet RFC documents at http://ds.internic.net/ds/dspg1intdoc.asp

The Encoding Steps

So now you know the basis for encoding all the data. Remember that all data sent on the Net is URI encoded. The rules used for encoding your data follow; they work for both the Post and the Get methods:

• Data is transferred as name/value pairs.
• Name/value pairs are separated from other name/value pairs by the ampersand (&).
• Name/value pairs are identified with each other by the equal sign (=). If no data is entered and a default value is defined, the value is the default value. If no default value is defined, the value is empty, but a name/value pair is sent.
• Spaces in value data are a special case. They are converted to the plus sign (+).
• Reserved characters cannot be used in the URI; they must be encoded.
• Characters that have special meaning (%, for example) must be encoded before being sent to the browser.
• Characters are encoded by converting them to their hexadecimal values.
• Encoded characters are identified as a percent sign followed by two hexadecimal digits (%NN).

Learning Perl

The Perl for and foreach statements are two of the power programming commands in Perl. The for statement should be familiar to most programmers, and it works as you would expect. In this "Learning Perl" section, you'll use the Perl for statement along with a few UNIX system commands to take a peek inside the UNIX password file. UNIX is such a trusting system that it lets just about anyone look around the system files. Here's your chance to see what the dark side, the evil hacker, is always trying to hack into.

It's the foreach statement, however, that really is a Perlism. The foreach statement generally is used for processing the Perl associative array. This makes the foreach statement special in Perl. Unique functions like the keys function are specially suited for the foreach statement and associative arrays. In this "Learning Perl" section, you'll become comfortable with Perl's for and foreach statements.

Listing 4.9. A basic for loop.
1: for ($count=1; $count < 101; $count++){ 2: take one forward step; 3: } 4: change direction;

01: #!/usr/local/bin/perl
02:
03: for ($NumberOfUsers=0; (@pwdlist = getpwent); $NumberOfUsers++){
04:     $user = $pwdlist[0];
05:     $userlist[$NumberOfUsers] = $user ;
06:     $shelltype = $pwdlist[8];
07:     $groupids  = $pwdlist[3];
08:     $shell_list{$shelltype}++;
09:     $group_list{$groupids}++;
10:     $usershell{$user} = $shelltype;
11: }
12:
13: for ($count = 0 ; $count < $NumberOfUsers; $count++){
14:    print "user number $count is $userlist[$count] \n";
15: }
16:
17: print "\n============================================\n";
18: foreach $group (keys(%group_list)){
19:     print "There are $group_list{$group} members of the $group group\n";
20: }
21:
22: print "\n============================================\n";
23: foreach $shell (keys(%shell_list)){
24:     print "There are $shell_list{$shell} users using the $shell shell\n";
25: }
26:
27:

01: #!/usr/local/bin/perl
02:
03: print "\n============================================\n";
04: foreach $number (1,2,3,7,12,15,"sixteen"){
05:     print "$number ";
06: }
07: print "outside the loop number is $number";
08:
09: print "\n============================================\n";
10: foreach $word ("one", "three", "five",8){
11:     print "$word ";
12: }
13: print "outside the loop word is $word";
14:
15: for ($NumberOfUsers=0; (@pwdlist = getpwent); $NumberOfUsers++){
16:     $userolder = $pwdlist[0];
17:     $userolderlist[$NumberOfUsers] = $userolder ;
18:     $shelltype = $pwdlist[8];
19:     $groupids  = $pwdlist[3];
20:     $shell_list{$shelltype}++;
21:     $group_list{$groupids}++;
22:     $useroldershell{$userolder} = $shelltype;
23: }
24:
25: print "\n============================================\n";
26: foreach $group (keys(%group_list)){
27:     print "There are $group_list{$group} members of the $group group\n";
28: }
29:
30: print "\n============================================\n";
31: foreach $userolder (sort(keys(%useroldershell))){
32:     print "$userolder uses the $useroldershell{$userolder}\n";
33: }
34:
35: print "\n============================================\n";
36: foreach $userolder (@userolderlist){
37:     print "userolder $userolder\n";
38: }
39: