URLs and Parameter Passing

URLs and Parameter Passing

The Query String of the URL is used to pass parameters to the application being invoked. When being invoked by the Web server, an application program receives two things from the Web server process: the system environment variables and the program parameters. The way in which Web application programs interact with Web servers is described in the Common Gateway Interface (CGI) specifications. The specifications specify that application programs spawned by Web servers receive the Query String contents both as command-line arguments and via a QUERY_STRING environment variable.

We can best describe how parameters are passed to applications with an example. We begin by creating a CGI script query.cgi on a Linux server whose IP address is 192.168.7.253. The contents of query.cgi are:

01: #!/bin/sh
02: set -f
03: echo Content-type: text/plain
04: echo
05: echo Number of command-line args: "$#"
06: echo command-line args: "$*"
07: echo GATEWAY_INTERFACE = "$GATEWAY_INTERFACE"
08: echo SERVER_PROTOCOL = "$SERVER_PROTOCOL"
09: echo REQUEST_METHOD = "$REQUEST_METHOD"
10: echo SCRIPT_NAME = "$SCRIPT_NAME"
11: echo QUERY_STRING = "$QUERY_STRING"

The script prints the number of command-line arguments supplied to it, the actual contents of the command-line arguments, and a few environment variables, which are set by the Web server when the script is invoked.

Now, let's send the following URL from a browser:

http://192.168.7.253/cgi-bin/query.cgi?Hello+World,+this+is+CGI

The Query String is "Hello+World,+this+is+CGI." The output from the script is:

Number of command-line args: 5
command-line args: Hello World, this is CGI
GATEWAY_INTERFACE = CGI/1.1
SERVER_PROTOCOL = HTTP/1.0
REQUEST_METHOD = GET
SCRIPT_NAME = /cgi-bin/query.cgi
QUERY_STRING = Hello+World,+this+is+CGI

The Web server places the Query String in the environment variable QUERY_STRING. It also decodes the string and passes the results as command-line arguments to query.cgi. Note that the + signs are replaced by spaces by the Web server.

Next let's send the following URL:

http://192.168.7.253/cgi-bin/query.cgi?item=A003&pmt=visa

The following results are displayed on our browser:

Number of command-line args: 0
command-line args:
GATEWAY_INTERFACE = CGI/1.1
SERVER_PROTOCOL = HTTP/1.0
REQUEST_METHOD = GET
SCRIPT_NAME = /cgi-bin/query.cgi
QUERY_STRING = item=A003&pmt=visa

This time, the Web server didn't pass the Query String as a command-line argument. However, the QUERY_STRING variable does contain the Query String contents. The difference is that, in this example, the Query String is constructed with the URL parameter passing standard, which lays down the specifications on how multiple parameter names and values can be passed to a Web application program. The general format for passing parameters via the Query String is:

http://server/app_program?param_name1=value1&param_name2=value2& param_nameN=valueN

If three parameters are passed to the application program, three parameter name and value pairs, joined by &, are placed on the Query String. The application then extracts the various parameter names and values that were passed to it.

Passing parameters to Web applications isn't restricted to the Query String method alone. Recall that HTTP provides two methods for requesting resources from Web servers: GET and POST. The relevance of each will become apparent when we discuss HTML forms, later on in this chapter.

 



Web Hacking(c) Attacks and Defense
Web Hacking: Attacks and Defense
ISBN: 0201761769
EAN: 2147483647
Year: 2005
Pages: 156

flylib.com © 2008-2017.
If you may any questions please contact us: flylib@qtcs.net