topic

Variable CGI environments

At start of a CGI-script the web - server passes him a lot of parameters in variables of environment{Wednesday}. The part of variables of environment{Wednesday} is generated by the web - server, and other part is formed of fields of HTTP-search.

In " Specification CGI/1.1 " the standard set of variables of CGI environment formed by the web - server, and also a way of transfer to a CGI-script of fields of HTTP-search in variables of environment{Wednesday} is described. Besides a number{line} of webs - servers (switching Apache) besides standard is formed with the variables in which pass a script additional ("non-standard") parameters (E-Mail the manager of the server, etc.).

Here are considered both standard variable CGI environments, and the variables formed by Apache server.

Variable CGI environments on a concrete hosting.

To see all variable environments accessible to a CGI-script on the concrete server, you can start on him a CGI-script deducing{removing} names and values of all variables of environment{Wednesday}:

*!/usr/bin/perl

print " Content-Type: text/htmlnn ";

print " <HTML> n <HEAD> </HEAD> <BODY>

<TR> <TD align=center> the Variable </TD> <TD align=center> Value </TD> </TR> n ";

foreach $itm (keys %ENV)

{print " <TR> <TD> $itm </TD> <TD> $ENV {$itm} </TD> </TR> n ";}

print " </TABLE> </BODY> </HTML> n ";

Depending on conditions of a call (a HTTP-method, a straight line or through SSI...) a set of variables can be various, therefore try to cause this script various ways and look results of job.

The variable CGI environments formed by the web - server.

QUERY_STRING - a line of parameters of a call (all symbols which have been written down in URL after a sign '?').

REQUEST_METHOD - method HTTP with which help the script is called. It is methods GET or POST though basically can be and others (PUT, DELETE, etc.) more often.

GATEWAY_INTERFACE - the version of interface CGI as CGI/x.y. For example, CGI/1.1

REMOTE_ADDR - contains the IP-address of a computer from which there was a reference{manipulation} to the web - server (the address of the client or last proxy).

REMOTE_PORT - TCP-port of the removed computer from which there is a search.

REMOTE_HOST - a domain name of the removed computer from which there is a search (it is defined{determined} by the web - server through DNS on value REMOTE_ADDR if it is authorized his{its} configuration).

SERVER_NAME - a domain name of the server.

SERVER_PORT - number{room} of TCP-port of the web - server.

SERVER_ADDR - the IP-address of the server.

SERVER_PROTOCOL - the version of the HTTP-report used for the given HTTP-search. For example, HTTP/1.1.

SERVER_SOFTWARE - the software of the server.

SCRIPT_NAME - a HTTP-way to a script.

SCRIPT_FILENAME - a physical full way to a script in file system of the server.

PATH_INFO - a HTTP-way to a script.

PATH_TRANSLATED - a full physical way to a script.

If the HTTP-method used for search provides transfer of contents to a body of search the following variables are passed:

CONTENT_TYPE - a content type (MIME).

CONTENT_LENGTH - length of contents

If has taken place autentificirovannyj search (with the instruction{indication} of a login name and the password) variables are passed:

AUTH_TYPE - type autentifikacii (used autentifikacionnaja the circuit). More often - 'Basic'.

REMOTE_USER - a login name, past autentifikaciju.

If the script is designed for service of several users, on parameter REMOTE_USER he can distinguish them. It is necessary to mean, that if the CGI-script is already started also to him parameter REMOTE_USER the user has already successfully passed autentifikaciju at a level of the web - server is transferred{handed}

Variable CGI-environments Apache

Apache web - server, depending on the version, can pass additional variables, in chasnosti, such:

DOCUMENT_ROOT - a physical way to the root WWW-catalogue of the server.

SERVER_ADMIN - E-Mail the address of the manager of the server.

It can be used, for example, for sending to the manager of the letter through the program sendmail or in a conclusion of the message on a mistake: if the mistake has unforeseen character, the script can advise to address to the user of a site to the manager on "such" E-Mail.

SERVER_SIGNATURE - the signature to the pages generated by the server (to listings, messages on a mistake). For example: Apache/1.3.3 Server at takoi-to.host.com Port 80

It can be used by a script for "emulation" of the certain mistake. For example, if to a script to address with wrong parameters it is possible to hide the fact of existence of such script, having given out the message " Not Found ".

Transformation of HTTP-fields of search to variable environments

Way of transformation of names of HTTP-fields of search in names of variables of the environment of a CGI-script the following:

1. All symbols are translated in the top register;

2. Symbols '-' are replaced on '_';

3. In the beginning of a name of a variable it is added ' HTTP _ '.

Thus, value of a field of HTTP-search Connection enters the name in a variable of HTTP_CONNECTION environment, and value of field Accept-Language - in variable HTTP_ACCEPT_LANGUAGE.

It is necessary to say, that in most cases not all fields of HTTP-search are passed a CGI-script.

HTTP_HOST - the host name to which there is a reference{manipulation}. It is convenient, if the script serves some virtual hosts.

HTTP_USER_AGENT - the software of the client who has queried. For example, Mozilla/4.7 [en] (Win95; I).

HTTP_ACCEPT - the list of content types supported by the client (through a point, by way of preference).

HTTP_ACCEPT_LANGUAGE - the list of languages supported by a browser as two-letter names (through a point), for example: ru, en. It is convenient, if the script can give out answers in several languages (we shall say, for Russian-speaking and English-speaking visitors of a site).

HTTP_ACCEPT_ENCODING - the list of supported methods of compression of the answer.

For example: gzip, deflate.

HTTP_ACCEPT_CHARSET - the list of supported codings of the text (through a point, by way of preference).

HTTP_CONNECTION - an operating mode of connection desirable by a browser: Keep-Alive (after the answer to search the server does not break off connection) and Close (the server breaks off connection after the answer to search).

HTTP_REFERER - value of field Referer of HTTP-search. In this field the browser passes URL a resource, under the link with which the given resource has been requested.

If the user passes under the link from page A to page B in field Referer of HTTP-search of page B will be URL pages A.

For pictures, external JavaScript, etc. the resources inserted in page, in field Referer it is passed URL pages into which they are inserted.

For the resources - scripts inserted through SSI, in variable HTTP_REFERER the same is passed, as for page where they are inserted.

HTTP_X_FORWARDED_FOR - if the user works through a proxy last forms field X-Forwarded-For in which specifies the IP-address from which there is a search to a proxy. If field X-Forwarded-Foruzhe exists in search to a proxy he adds to already existing field new value through a point. Thus, if the client works "in cascade" through some proxies the first proxy will create field X-Forwarded-For with IP the client, and each subsequent proxy will add to already existing field X-Forwarded-For the address of the previous proxy through a point.

Thus, it is possible to trace all chain of in cascade switched on proxies of servers if, certainly, any of them is not "anonymous".

Thus it is necessary to mean, that the IP-address of the client working through a proxy can and not belong to the Internet if the client works from a local area network. Usually for local area networks addresses of a kind 172.16.x.y are used.

The variable environments transmitted to a CGI-script, called through SSI.

To the CGI-script called through SSI, Apache server passes also additional variable environments:

QUERY_STRING_UNESCAPED - parameters of a call not the script, and web - page containing it{him}. All escape-sequences of a kind %xx are already replaced with symbols. In variable QUERY_STRING as it is usual, parameters of a call of the script in the SSI-directive are passed. Thus, the CGI-script called through SSI, can process parameters of a call of HTML-page containing it{him} if they are.

REQUEST_URI - a HTTP-way to the web - page containing the SSI-directive of a call of a script.

DOCUMENT_NAME - a name of a file of the document (web - page) into which the result of job of a script is inserted.

DOCUMENT_URI - a HTTP-way to the web - page called this script.

LAST_MODIFIED - date of last change of the document into which the result of job of this script is inserted.

DATE_LOCAL And DATE_GMT - accordingly local date - time and date - time across Greenwich.

For the CGI-scripts called through SSI, variable SERVER_PROTOCOL matters 'INCLUDED'.