4 ms·
Really? Escaping, people! This code isn't practical or useful; it's dangerous and sloppy. cout << "<body>\n"; ... cout << getenv("QUERY_STRING");
by chubot 9y ago
Really? Escaping, people! This code isn't practical or useful; it's dangerous and sloppy.
cout << "<body>\n";
...
cout << getenv("QUERY_STRING");
cout << "</body>\n";
FWIW I wrote an article about HTML escaping and shell here: http://www.oilshell.org/blog/2017/09/19.html http://www.oilshell.org/blog/2017/09/19.html
Followup: http://www.oilshell.org/blog/2017/09/29.html http://www.oilshell.org/blog/2017/09/29.html
Also if you want to use a native language for web sites (which I don't), Go is a better choice, as the standard library has html/template which protects you from naive injections:
https://golang.org/pkg/html/template/ https://golang.org/pkg/html/template/
- entropie 9y ago> In this article, I’ll explain how you can use C++ to develop a website and some concrete reasons why you might consider doing so. I dont find any reasons at all. That article ist just a clickbait nonsens.
- carterehsmith 9y ago"Building a Website with C++" "Is This Even Possible?" We can just "flag" articles like this one.
- flatline 9y agoCTemplate is a not-unreasonable option for C++ as well.
- bcjpjk 9y agoYeah... this example code is bad. Not to mention that CGI is slow, problematic, and chock full of potential security issues. At the very least, spawning a process per request is a DOS attack waiting to happen, even if the code were immaculate.
- poizan42 9y agoClassic CGI is not the best performing interface, yes. But there's a big difference in launching a complete interpreter for every request, and running a small purpose-built native program. And remember that people did manage the former 20 years ago, sites like Slashdot were running CGI Perl scripts back then. I'm not sure about the "chock full of potential security issues". You have to be careful with trusting environment variables as the Bash guys learned, but I don't know what else there is that is specific to CGI.
- jayrwren 9y agoForking a process per request is expensive, interpreter or not. Slashdot used apache mod_perl back then. It never forked a process per request.
- goldenkey 9y agoCGI was commonly used by everybody and anybody in those years. I recall Slashdot having some CGI pages, not everything but forms processing.
- poizan42 9y agoSlashdot started in 1997, the first release of mod_perl was on 12.03.1998. They certainly used cgi at first, just check the url here: https://web.archive.org/web/19980113191337/http://slashdot.org:80/slashdot.cgi?mode=contrib https://web.archive.org/web/19980113191337/http://slashdot.o... - it says cgi right there. Edit: Seems I was wrong about the date, it was actually 28-Jul-1997[1], nevertheless slashdot was only launched two months later, and as the link above witnesses didn't seem to have used it at first. [1]: https://web.archive.org/web/19971210053529/http://perl.apache.org:80/src/ https://web.archive.org/web/19971210053529/http://perl.apach...
- candiodari 9y agoThen I have good news for you ! https://en.wikipedia.org/wiki/FastCGI https://en.wikipedia.org/wiki/FastCGI Also: DOS attacks against capacity sound positively benign compared to what they translate to on cloud : DOS on your credit card.
- mcosta 9y agoWhat is lambda?