Venice Beach, California.

Chapter 10: Sites That Are Really Programs


Revised July 2003

Venice Beach, California. The classic (circa 1993) Web site comprises static .html files in a Unix or Windows file system. This kind of site is effective for one-way non-collaborative publishing of material that seldom changes.

You needn't turn your Web site into a program just because the body of material that you are publishing is changing. Sites such as, for example, are sets of static files that are periodically generated by programs grinding through a dynamic database. With this sort of arrangement, the site inevitably lags behind the database but you can handle millions of requests a day without a major investment in computer hardware, custom software, or thought.

If you want to make a collaborative site, however, at least some of your Web pages will have to be computer programs. Pages that process user submissions have to add user-supplied data to your Web server's disk. Pages that display user submissions have to look through a database on your server before delivering the relevant contributions.

In older times, if you wanted to publish completely static, non-collaborative material, at least one portion of your site would require server-side programming: the search engine. To provide a full-text search over the material on a site, the server would have to take a query string from the user, compare it to the files on the disk, and then return a page of links to relevant documents. Nowadays most people who wanted to do this would instead build a form targeting Google with hidden form variables that will restrict the search to the originating site's domain (see to set this up).

This chapter discusses the options available to Web publishers who need to write program-backed pages. Here are the steps:

  1. Decide whether you're building a dynamic document or a program with a Web interface.
  2. Choose a computer language.
  3. Choose a program invocation mechanism.
  4. Choose a Web server program to support the first three choices.

Step 1: Document or Program?

A document is typically edited or updated over a period of days. Changes in one portion of a document don't have far-reaching implications for other portions. A computer program is typically versioned, debugged, and tested over a period of months.

Every interesting Web site has some characteristics of both a document and a computer program. There is thus no correct answer to the question "Is your site a hypertext document with bits of computation or a computer program with bits of static text?" However, the tools that make it easy for a team of experts to develop a computer program will get in the way if your site is fundamentally a document. Conversely, the tools that make it convenient to edit a document can lead to sloppy and error-filled computer programs.

Server-side programming systems that take the document model to its logical extreme is Microsoft Active Server Pages (ASP). A vanilla HTML file is a legal ASP document. If you want to add some computation, you weave in little computer language fragments, surrounded by <% ... %>. If you want to fix a typo or a programming bug, you edit the .adp or .asp file and hit reload in your Web browser to see the new version. Almost always, the connection is direct and immediate between the URL where the problem was observed and the file on the server that you must edit. You don't have to understand much of the document's structure to fix a bug.

At the other end of the document/program spectrum are various "application servers" that require you to program in C or Java. HTML text is inevitably buried inside these programs. Fixing a typo requires editing the program, compiling the program, and reloading the compiled code into the Web or application server. If there is a problem with a URL, fixing it might require reading and editing dozens of program files and understanding most of the program's overall structure.

With the right tools and programmer resources, you can build a jewel-like software system to sit behind a Web site. But ask yourself whether the entire service isn't likely to be redesigned after six months, and if, realistically, your site isn't going to be thrown together hastily by overworked programmers. If so, perhaps it will be best to look for the tightest development cycle.

Step 2: Choose a Computer Language

People usually choose a computer language according to how well it supports management of complexity. Much of the complexity in a web site, however, is in the number of URLs and how they interact (i.e., how many form-variable arguments get passed from one page to another). So the system structure is very similar regardless of the computer language employed.

Consider these aspects:

"PHP is a pet peeve of mine. They spent ungodly hours inflicting their own new scripting language on the world that is almost exactly like Perl."
-- a programmer friend who has suffered through 10 years of gratuitious changes in open-source Web development tools
You would think that picking a Web site development language would be trivial. Obviously the best languages are safe and incorporate powerful object systems. So let's do everything in Common Lisp or Java. Common Lisp can run interpeted as well as compiled, which makes it a more efficient language for developers. So Common Lisp should be the obvious winner of the Web server language wars. Yet nobody uses Common Lisp for server-side scripting. Is that because Java-the-hype-king has crushed it? No. In fact, to a first approximation, nobody uses Java for server-side scripting. Almost everyone is using simple interpreted languages such as Visual Basic, PHP, Perl, or Tcl.

How could a lame string-oriented scripting language possibly compete in power with systems programming languages? Well, guess what? The only data type that you can write to a Web browser is a string. And all the information from the relational database management system on which you are relying comes back to to the Web server program as strings. So maybe it doesn't matter whether your scripting language has an enfeebled type system.

Are these languages really the best? Computer scientists can't believe that a scripting language could be as good as Lisp and better than Java for developing Internet applications. But it turns out to be almost true. A scripting language is better than Java because a scripting langauge doesn't have to be compiled. A scripting language can be better than Lisp because string manipulation is simpler. For example, in Tcl or Perl

"posted by $email on $posting_date."
will generate a string from the fragments of static ASCII above plus the contents of the variables $email and $posting_date. These were presumably recently pulled from a relational database. The result might look something like

"posted by on February 15, 1998."
In Common Lisp, you'd have

(concatenate 'string "posted by " email " on " posting-date ".")
which uses a fabulously general mechanism for concatenating sequences. concatenate can work on sequences of ASCII characters (strings) or sequences of TCP packets or sequences of three-dimensional arrays or sequences of double-precision complex numbers. Sequences can either be lists (fast to modify) or vectors (fast to retrieve). This kind of flexibility, which Java apes, is wonderful except that Web programmers are concatenating strings 99.99 percent of the time and the scripting languages' syntactic shortcuts make code easier to read and more reliable.

If your source of persistent storage were an object database, which can directly represent complex types, a language such as C#, Common Lisp, or Java would be very useful for writing individual Web pages. But in our current world, which is overwhelming dominating by the relational database management system and its three types (string, number, and date), these languages add very little power.

Finally, don't forget that even if you're developing individual pages in a scripting language you can write substrate programs in C#, Java, PL/SQL and other more complex languages. If you're using the Microsoft .NET environment methods of C# classes can be invoked by any VB.NET program. If you want to do sophisticated computation on information that comes from the relational database, typically that can be done by a Java or PL/SQL program running inside Oracle or by a C# program running inside Microsoft SQL Server.

Step 3: Choose a Program Invocation Mechanism

Otters.  Audubon Zoo.  New Orleans, Louisiana. What happens after the user requests a dynamic page? How does the server know that a program needs to be called and what does it have to do to run that program?

The oldest mechanism for program invocation via the Web is the Common-Gateway Interface (CGI). The CGI standard is an abstraction barrier that dictates what a program should expect from the Web server, for example, user form input, and how the program must return characters to the Web server program for them to eventually be written back to the Web user. If you write a program with the CGI standard in mind, it will work with any Web server program. You can move your site from Apache to Microsoft Internet Information System (IIS) and all of your CGI scripts will still work. You can give your programs away to other Web publishers who aren't running the same server program. Of course if you wrote your CGI program in C and compiled it for a Linux box, it might not run so great on a Windows XP machine.


We've just discovered why most CGI scripts are written in Perl, PHP, Tcl, or some other interpreted computer language. The systems administrator can install the Perl or Tcl interpreter once and then Web site developers on that machine can easily run any script that they download from another site.

Fixing a bug in an interpreted CGI script is easy. A message shows up in the error log when a user accesses "". If your Web server document root is at /web, then you know to edit the file /web/bboard/ After you've found the bug and written the file back to the disk, the next time the page is accessed the new version of the subject-lines Perl script will be interpreted.

For concreteness, let's summarize Unix CGI:

It is all pretty much the same on Windows but the author hasn't personally attempted it. Here's an example CGI program:
# and put the result after the #!
# show up on the user's screen
This example program will print "Hello World" as a level-3 headline. If you want to get more sophisticated, read some on-line tutorials or CGI Programming with Perl (Birznieks et al; O'Reilly 2000).

It is that easy to write Perl CGI scripts and get server independence, a tight software development cycle, and ease of distribution to other sites. With that in mind, you might ask how many of the thousands of dynamic Web pages on popular Web sites use this program invocation mechanism. The answer? Maybe a couple.

Enter the server application programming interface (API). As discussed in the "So You Want to Run Your Own Server" chapter, most Web server programs allow you to supplement their behavior with extra software that you write. This software will run inside the Web server's process, saving the overhead of forking CGI scripts. Because the Web server program will generally run for at least 24 hours, it becomes the natural candidate to be the RDBMS client.

All Web server APIs allow you to specify "If the user makes a request for a URL that starts with /foo/bar/ then run Program X". The really good Web server APIs allow you to request program invocation before or after pages are delivered. For example, you ought to be able to say "When the user makes a request for any HTML file, run Program Y first and don't serve the file if Program Y says it is unhappy". Or "After the user has been served any file from the /car-reviews directory, run Program Z" (presumably Program Z performs some kind of logging).

Step 4: choose a Web server program to support the first three choices

Remember the steps:
  2. Choose a computer language.
  3. Choose a program invocation mechanism.
You've made the first three choices. Now you have to look around for Web server software that will support them. If you've settled on CGI as a program invocation mechanism, it won't really matter which server you use (server independence being the main point of CGI, after all). If you want to use a server's API, then you need to find a server program that supports the language and development style that you've chosen in steps 1 and 2.

Example 1: Redirect

100th Anniversary Boston Marathon (1996). Our first foray in the Web publishing world was installing the NCSA 1.3 Web server program on our research group's file server, We didn't bother to make an alias for the machine like "" so the URLs we distributed looked like "".



Two years later, in August 1996, someone upgraded Martigny from HP-UX 9 to HP-UX 10. Nobody bothered to install a Web server on the machine. Email began to trickle in "I searched for you on the Web but your server has been down since last Thursday." Eventually we figured out that the search engines were still sending people to Martigny, a machine that was in no danger of ever responding to a Web request since it no longer ran any program listening to port 80.

The one store on Chappaquiddick, Martha's Vineyard, Massachusetts.  It is a combination beer/ice shop and junkyard Those were the early days of Apache and we couldn't get it to compile. We downloaded an expensive commercial Web server made by a now-defunct company called "Netscape". It was a $5000 product, free to universities, with a built-in redirect facility but sadly there was a bug in the program and the redirects didn't work. Because the product was closed-source we couldn't fix it ourselves. Finally we installed AOLserver, which did not have a neat redirect facility, but its Tcl API seemed flexible enough that it would be possible to make the server do whatever we wanted.


ns_register_proc GET / martigny_redirect


proc martigny_redirect {} {
    append url_on_swissnet "" [ns_conn url]
    ns_returnredirect $url_on_swissnet



Example 2: Customizing Access

Chappaquiddick, like the rest of Martha's Vineyard (Massachusetts) has only a tiny bit of public beach MIT Press wanted to sell subscriptions to electronic journals either to institutions or to individuals. They also wanted portions of the journals to be freely available. In the case of an institutional subscriber, the server needed to recognize that the client came from a range of authorized IP addresses, e.g., any computer whose IP address starts with "36." is at Stanford, so if they've paid for a site-wide subscription, don't demand username or password from Chappaquiddick Beach Club, sort of part of Martha's Vineyard, Massachusetts individuals. For individuals, they decided to start by simply distributing the same username/password pair to all the subscribers. All of the information about who was authorized had to come from their relational database. It turned out that this set of constraints was too complex for the standard permissions module that comes with AOLserver, if only because it uses its own little Unix files-based database. Fortunately, the AOLserver API provides for program invocation prior to page service via a mechanism called filters. After 20 minutes we came up with the following program:
# tell AOLserver to watch for PDF file requests under the /ejournal directory
# if we don't add additional ns_register_filter commands, all the 
# other files will be available to everyone
ns_register_filter preauth GET /ejournal/*.pdf ejournal_check_auth

proc ejournal_check_auth {args why} {
    # all the parameters we might want to change
    set user "open"
    set passwd "sesame"
    # on the real-life server, these are pulled from a relational database
    # but here for an example, let's just set it to MIT and Stanford
    set allowed_ip_ranges [list "18.*" "36.*"]

    foreach pattern $allowed_ip_ranges {
	if { [string match $pattern [ns_conn peeraddr]] } {
	    # a paying customer; the file will be sent
	    return "filter_ok"

    # not coming from a special IP address, let's check the 
    # username and password headers that came with the request
    if { [ns_conn authuser] == $user && [ns_conn authpassword] == $passwd } {
	# they are an authorized user; the file will be sent
	return "filter_ok"

    # not a good IP address, no headers, hammer them with a 401 demand
    ns_set put [ns_conn outputheaders] WWW-Authenticate "Basic realm=\"MIT Press:Restricted\""
    ns_returnfile 401 text/html "[ns_info pageroot]ejournal/please-subscribe.html"

    # stop AOLserver from handling the request by returning a special code
    return "filter_return"

Example 3: Aid to Evaluating Your Accomplishments (randomizing a page)

Car Wash.  Monterey, California
-- Michael Booth's comment on the "Women in Computing" page
Computer science graduate students earn a monthly stipend that wouldn't cover the average yuppie's SUV payments and gas bill. If you've been reading Albert Camus lately ("It is a kind of spiritual snobbery to think one can be happy without money") then you'd expect this to lead to occasional depression. For these depressed souls, there is Career Guide for Engineers and Scientists (


Thought 2: custom photography would help get the message across (see ).

Thouht 3: we could really get under the skin of America's best and brightest young computer scientists with Aid to Evaluating Your Accomplishments (see ).

Here's the source code:

# a helper procedure to pick N items randomly from a list
# note that it uses tail-recursion, importing a little bit 
# of the clean Scheme philosophy into the ugly world of Tcl

proc choose_n_random {choices_list n_to_choose chosen_list} {
    if { $n_to_choose == 0 } {
	return $chosen_list
    } else {
	set chosen_index [randomRange [llength $choices_list]]
	set new_chosen_list [lappend chosen_list [lindex $choices_list $chosen_index]]
	set new_n_to_choose [expr $n_to_choose - 1]
	set new_choices_list [lreplace $choices_list $chosen_index $chosen_index]
	return [choose_n_random $new_choices_list $new_n_to_choose $new_chosen_list]

# we encapsulate the printing of an individual person so that 
# one day we can easily change the design of the page (we display
# four people at once and putting this in a procedure keeps us from
# having to edit the same code four times).

proc one_person {person} {
    set name [lindex $person 0]
    set title [lindex $person 1]
    set achievement [lindex $person 2]
    return "<h4>$title $name</h4>\n $achievement <br><br> <center> (<a href=\"[ns_urlencode $name]\">more</a>) </center>\n"

# we return HTTP headers to the client


# we return as much of the page as we can before figuring out which four
# people we're going to display; this way if we were going to query a 
# relational database (potentially taking 1/2 second), the user would
# have something on-screen to read

ns_write "<html>
<title>Aid to Evaluating Your Accomplishments</title>

<body bgcolor=#ffffff text=#000000>
<h2>Aid to Evaluating Your Accomplishments</h2>

part of <a href=\"/philg/careers.html\">Career Guide for Engineers and Scientists</a>


Compare yourself to these four ordinary people who were selected at random:


# each person is name, title, accomplishment(s)

set einstein [list "A. Einstein" "Patent Office Clerk" \
                   "Formulated Theory of Relativity."]

set mill [list "John Stuart Mill" "English Youth" \

set mozart [list "W. A. Mozart" "Viennese Pauper" \
                 "Composed his first opera, <i>La finta
                 semplice</i>, at the age of 12."]

set jesus [list "Jesus of Nazareth" "Judean Carpenter" \
                "Told young women he was God and they believed him."]

set stevens [list "Wallace Stevens" "Hartford Connecticut Insurance Executive" 
                  "Won Pulitzer Prize for Poetry in 1954; best known for
                   \"Thirteen Ways of Looking at a Blackbird\"."]

# ... there are a bunch more in the real live script

set average_folks [list $einstein $mill $mozart $jesus]

# we call our choose_n_random procedure, note that we give it an empty
# list to kick off the tail-recursion

set four_average_folks [choose_n_random $average_folks 4 [list]]

ns_write $conn "<table cellpadding=20>
<td valign=top>
[one_person [lindex $four_average_folks 0]]
<td valign=top>
[one_person [lindex $four_average_folks 1]]
<td valign=top>
[one_person [lindex $four_average_folks 2]]
<td valign=top>
[one_person [lindex $four_average_folks 3]]

# note how in the big block of static HTML below, we're forced to 
# put backslashes in front of the string quotes.  This is annoying 
# and we wouldn't have to do it if we'd implemented this using
# AOLserver Dynamic Pages (where the text is HTML by default, 
# Tcl code by exception).

ns_write $conn "


Programmed by <a href=\"\">Eve
Astrid Andersson</a> and <a href=\"/philg/\">Philip Greenspun</a> in
<a href=\"/wtr/servers.html#naviserver\">AOLserver Tcl</a>.  If you're
a nerd, you might find <a href=\"four-random-people.txt\">the source
code</a> useful.


Original Inspiration: <cite>How to Make Yourself Miserable</cite>, by
Dan Greenburg

<a href=\"/philg/\"><address></address></a>

Example 4: Focal Length Calculator (taking data from users)


The forms user interface model fell into the shade after 1984 when the Macintosh "user drives" pull-down menu system was introduced. However, HTML forms as classically conceived work exactly like the good old 3270. Here's an example that is firmly in the 3270 mold, taken from the Lens chapter of my photography tutorial textbook ( The basic idea is to help people figure out what size lens they will need to buy or rent in order to make a particular image. They fill in a form with distance to subject and the height of their subject (see ). The server then tells them what focal length lens they need for a 35mm camera.

Here's the HTML source for the form:

<form method=post action=focal-length.tcl>
How far away is your subject?  
<input type=text name=distance_in_feet size=7>  (in feet)
How high is the object you want to fill the frame?  
<input type=text name=subject_size_in_feet size=7>  (in feet)


<input type=submit>


Here's the AOLserver Tcl program that processes the user input:


# distance_in_feet, subject_size_in_feet are the args from the form
# they are now set in Tcl local variables thanks to the magic 
# utility function call above

# let's do a little IBM mainframe-style error-checking here

if { ![info exists distance_in_feet] || [string compare $distance_in_feet ""] == 0 } {
    ns_return 200 text/plain "Please fill in the \"distance to subject\" field"
    # stop the execution of this script

if { ![info exists subject_size_in_feet] || [string compare $subject_size_in_feet ""] == 0 } {
    ns_return 200 text/plain "Please fill in the \"subject size\" field"
    # stop the execution of this script

# we presume that subject is to fill a 1.5 inch long-dimension of a
# 35mm negative

# ahhh... the joys of arithmetic in Tcl, a quality language so 
# much cleaner than Lisp

set distance_in_inches [expr $distance_in_feet * 12]
set subject_size_in_inches [expr $subject_size_in_feet * 12]

set magnification [expr 1.5 / $subject_size_in_inches]

set lens_focal_length_inches [expr $distance_in_inches / ((1/$magnification) + 1)]

set lens_focal_length_mm [expr round($lens_focal_length_inches * 25.4)]

# now we return a page to the user, one big string into which we let Tcl
# interpolate some variable values

ns_return $conn 200 text/html "<html>
<title>You need $lens_focal_length_mm mm </title>

<body bgcolor=#ffffff text=#000000>
<a href=\"/images/pcd0952/boston-marathon-46.tcl\"><img HEIGHT=198 WIDTH=132 src=\"/images/pcd0952/boston-marathon-46.1.jpg\" ALT=\"100th Anniversary Boston Marathon (1996).\"></a>

<h2>$lens_focal_length_mm millimeters</h2>

will do the job on a Nikon or Canon or similar 35mm camera


(according to the <a href=\"\"> lens tutorial</a> calculator)



Here are the raw numbers:

<li>distance to your subject:  $distance_in_feet feet ($distance_in_inches inches)
<li>long dimension of your subject:  $subject_size_in_feet feet ($subject_size_in_inches inches)
<li>magnification:  $magnification
<li>lens size required:  $lens_focal_length_inches inches ($lens_focal_length_mm mm)


Assumptions: You are using a standard 35mm frame (24x36mm) whose long
dimension is about 1.5 inches.  You are holding the camera in portrait
mode so that your subject is filling the long side of the frame.  You
are supposed to measure subject distance from the optical midpoint of
the lens, which for a normal lens is roughly at the physical midpoint.


Source of formula:  <a href=\"\">Kodak 
Professional Photoguide</a>
Source of server-side programming knowledge:  Chapter 9 of 
<a href=\"\">How to be a Web Whore Just Like Me</a>
Time required to write this program:  15 minutes. 
Proof that philg is a nerd:  <a href=\"focal-length.txt\">view the source code</a>

What this is not: a slow Java program that will crash everyone's browser (except those behind corporate firewalls that block all Java applets)


Another thing this is not:  a CGI program that will make my poor old Unix box fork


Yet another thing this is not: a JavaScript program that you'd think
would be the right thing but then on the other hand it wouldn't work with some browsers and the last thing that I need is email from confused users

<h3>Bored?  Try again</h3>

<form method=post action=focal-length.tcl>
How far away is your subject?  
<input type=text name=distance_in_feet size=7 value=\"$distance_in_feet\">  (in feet)
How high is the object you want to fill the frame?  
<input type=text name=subject_size_in_feet size=7 value=\"$subject_size_in_feet\">  (in feet)


<input type=submit>


<h3>European?  Macro-oriented?</h3>

<form method=post action=focal-length-mm.tcl>
How far away is your subject?  
<input type=text name=distance_in_mm size=7>  (in millimeters)
How high is the object you want to fill the frame?  
<input type=text name=subject_size_in_mm size=7>  (in millimeters)


<input type=submit>



Example 5: Bill Gates Personal Wealth Clock (taking data from foreign servers)

Academic computer scientists are the smartest people in the world. There are an average of 800 applications for every job. And every one of those applicants has a PhD. Anyone who has triumphed over 799 PhDs in a meritocratic selection process can be pretty sure that he or she is a genius. Publishing is the most important thing in academics. Distributing one's brilliant ideas to the adoring masses. The top computer science universities have all been connected by the Internet or ARPAnet since 1970. A researcher at MIT in 1975 could send a technical paper to all of his or her interested colleagues in a matter of minutes. With this kind of heritage, it is natural that the preferred publishing medium of 21st Century computer science academics is . . . dead trees.

Yes, dead trees.


Anyway, with foresight like this, it is only natural that academics like to throw stones at successful unworthies in the commercial arena. The "Why Bill Gates is Richer than You" section on didn't come into its own until the day Brian announced to our little research group at MIT that the U.S. Census Bureau had put up a real-time population clock at There had been stock quote servers on the Web almost since Day 1. How hard could it be to write a program that would reach out into the Web and grab the Microsoft stock price and the population, then do the math to come up with what you see at (see ).

This program was easy to write because the AOLserver Tcl API contains the ns_httpget procedure. Having a personal server grab a page from the Census Bureau is as easy as

ns_httpget ""

Tcl the language made life easy because of its built-in regular expression matcher. The Census Bureau and the Security APL stock quote folks did not intend for their pages to be machine-parsable. Yet only a short program was necessary to pull the raw numbers out of a page designed for reading by humans.

Anyway, here is the code. Look at the comments.

# this program copyright 1996, 1997 Philip Greenspun (
# redistribution and reuse permitted under
# the standard GNU license
proc wealth_RawQuoteToDecimal {raw_quote} {
 # there was a space
     # there was a "/"
     return [expr $whole + $extra]
 # we couldn't parse the fraction
 return $whole
    } else {
 # we couldn't find a space, assume integer
 return $raw_quote
#   done defining helpers, here's the meat of the page
# grab the stock quote and stuff it into QUOTE_HTML
set quote_html [ns_httpget ""]

# regexp into the returned page to get the raw_quote out
       $quote_html match raw_quote

# e.g., "99.125"
set msft_stock_price [wealth_RawQuoteToDecimal $raw_quote]
set population_html [ns_httpget ""]

# by taking out the commas
       $population_html match millions thousands units

# brain damaged model of numbers and thinks "039" is octal
# this is when you kick yourself for not using Common Lisp
set trimmed_millions [string trimleft $millions 0]
set trimmed_thousands [string trimleft $thousands 0]
set trimmed_units [string trimleft $units 0]

# then we add them back together for computation
set population [expr ($trimmed_millions * 1000000) + \
                     ($trimmed_thousands * 1000) + \

# and reassemble them in a string for display
set pretty_population "$millions,$thousands,$units"

# precision floating point right here.
# words of memory; Common Lisp programs perform arithmetic correctly.
set gates_shares_pre_split [expr double(141159990)]
set gates_shares [expr $gates_shares_pre_split * 2]
set gates_wealth [expr $gates_shares * $msft_stock_price]
set gates_wealth_billions \
set personal_share [expr $gates_wealth / $population]

# we're done figuring, now let's return a page to the user
ns_return 200 text/html "<html>
<title>Bill Gates Personal Wealth Clock</title>
<body text=#000000 bgcolor=#ffffff>
<h2>Bill Gates Personal Wealth Clock</h2>
just a small portion of 
<tr><td>Microsoft Stock Price:
    <td align=right> \$$msft_stock_price
<tr><td>Bill Gates's Wealth:
    <td align=right> \$$gates_wealth_billions billion
<tr><td>U.S. Population:
    <td align=right> $pretty_population

So is this the real code that sits behind

Actually, no.



Does this sound like overengineering? It didn't seem that way when Netscape, then makers of the world's most popular Web browser, put the Wealth Clock on their What's New page for two weeks (summer 1996). The URL was getting two hits per second. Per second. And all of those users got an instant response. The extra load on the Web server was not noticeable. Meanwhile, all the other sites on Netscape's list were unusably slow. Popularity had killed them.

Here are the lessons from this example:

Epilogue: Our friend Brian, who started the whole Wealth Clock craze with his Census Bureau site discovery, now works at Microsoft, along with all the other smart computer science PhDs that we know who aren't at universities.

Example 6: AOLserver Dynamic Pages

As long as we're on the subject of Bill Gates, it is worth demonstrating the syntax and style that his company inspired with its Active Server Pages. The folks at America Online fell in love with this idea but not with the idea of forever wedding their Web services to Windows and IIS. Thus they added a similar facility to AOLserver called AOLserver Dynamic Pages (ADP), which underly the original WimpyPoint system, described in Chapter 1.

The idea is that someone will come to the site, look for the name of the author, then click down to find the presentation of interest.

Here's the ADP source code:

<% wimpy_header "Choose Author" %>

<h2>Choose an Author</h2>

in <a href="/"><%=[wimpy_system_name]%></a>


Here's a list of users who have public presentations:



set db [ns_db gethandle]
set selection [ns_db select $db "select distinct u.user_id, u.last_name, u.first_names,
from wimpy_users u, wimpy_presentation_ownership wpo, wimpy_presentations wp
where u.user_id = wpo.user_id
and wpo.presentation_id = wp.presentation_id
and wp.public_p = 't'
order by upper(u.last_name), upper(u.first_names)"]

while { [ns_db getrow $db $selection] } {
    ns_puts "<li><a href=\"user-top.adp?user_id=$user_id\">$last_name, $first_names ($email)</a>\n"



Or you can do a full-text search through all the slides:

<form method=GET action="search.adp"> 
Query String:  <input type=text name=query_string size=50>
<input type=submit value="Submit">

<% wimpy_footer %>
Note that one is allowed to use arbitrary HTML, including string quotes, at the top level of the file. Note further that there are two escapes to the ADP evaluator. The basic escape is <%, which will execute a bunch of Tcl code for effect. If the Tcl code wants to write some bytes to the browser, it has to call ns_puts. The second escape sequence is <%=, which will execute a bunch of Tcl code and then write the result out to the browser. Generally one uses the <%= style for simple things, e.g., including the system name that is returned from the Tcl procedure wimpy_system_name. One uses the <% style to execute a sequence of Tcl procedures to query the database, etc.

Example 7: Active Server Pages

I haven't personally written any Microsoft Active Server Pages. Fortunately, Microsoft set up Windows/IIS/ASP back in the mid-1990s such that if you were curious to see the source code behind, you had only to type "" (note the trailing period) into your browser and the foreign server would deliver the source code right to your desktop. This was a great convenience for people trying to learn ASP; however, it presented something of a security problem for Web publishers, because they would often have their database or system administration passwords in the source code. It seems that Microsoft's intention was not to make public all of its customers' source code and hence they eventually released a security patch to change this behavior. However, a few months later people learned that requesting "$DATA" (note the trailing "::$DATA") would also get them the source code.

A nice collection of ASP examples at was harvested in just a couple of hours of surfing one night in July 1998. It is a bit interesting that this surfing was done some time after the bug had become common knowledge yet companies such as DIGITAL, Arthur Andersen, and banks had not patched their servers. What is even more interesting is that by July 2003 nearly all of those companies have gone bankrupt or been absorbed.

firewall.asp is amusing because it is DIGITAL's advertisement for their network security products. Similarly GAP Instrument Corp. took the trouble to warn users

You have reached a computer system providing United States government information. Unauthorized access is prohibited by Public Law 99-474, (The Computer Fraud and Abuse Act of 1986) and can result in administrative, disciplinary or criminal proceedings.
yet had left their ASP pages wide open.

CompuServe gives us a nice simple example with Conf.asp. The goal of the script is to first figure out whether the person browsing is a CompuServe member or not and then serve one of two entirely separate HTML pages. An if statement is thus opened inside one <% %> and closed in another:

<!--#INCLUDE VIRTUAL="/Forums/"-->
<% if member = 1 then %>
<TITLE>TW Crime Forum</TITLE>

... ** a page for members *** ..


<BR><I>We Update the Forum Directory Weekly.  The directory was last updated: Thursday, January 08, 1998</I>

<% else %>
<TITLE>TW Crime Forum</TITLE>

... ** a page for non-members ***

<%End If%>
An interesting thing to note about this page is that CompuServe hasn't run their HTML through a syntax checker, which would no doubt have complained about the stuff after the </HTML> (I've highlighted the extraneous text in bold, above).

Let's move on to some db-backed pages.

The folks who built Fulton Bank's site are very enthusiastic about Microsoft:

"The hottest technology to hit the Internet which is actually useable now is Active Server Page scripting. This has given us a number of advantages over the ancient art of CGI. ... Intranets and Extranets where the variety of user machine platforms, processors, etc are an issue ASP can play in nicely."
-- (once apparently a thriving Web development concern, now apparently bankrupt)
Let's see how ASP works for them in process_product.asp, a script that takes a query string and tries to find banking products that match this query string.
<% affcode = 1057 %>

<TITLE>Fulton Bank</TITLE>

<TABLE WIDTH=370 ALIGN="middle">
<IMG SRC="images/header_products.gif"><BR>

   Set Conn=Server.CreateObject("ADODB.Connection")
   Conn.Open "FultonAffiliates"

   SQL = "SELECT * 
FROM products 
WHERE productname 
LIKE '%" & Request.Form("product") & "%' 
AND affiliate = '" & affcode & "'"

   Set RS = Conn.Execute(SQL)


<% if RS.EOF then %>
<TR><TD>Sorry No Products Found</TD></TR>
<% end if %>

<TD VALIGN="top"><IMG SRC="images/diamond3.gif"></TD>
<A HREF="<% = RS("url") %>"><FONT COLOR="blue"><% = RS("productname") %></FONT></A><BR>
<% = RS("shortdesc") %><BR>
<BR> <BR>
<% RS.MoveNext %>
<% LOOP %>
<% rs.close
This is some pretty clean code. The programmers have encapsulated the database password in their ODBC connection configuration. Also, rather than just bury the magic number "1057" in the code, they set affcode to it as the very first line of the program. Finally, they've parked the page footer in a centralized footer.asp file that gets included by all of their scripts.




or move on to Chapter 11: Sites that are really databases

Reader's Comments

Note that the final example has a major security flaw - it incorporates strings from the users request directly into the text of a sql query. This is subject to 'SQL Injection' - carefully crafted sql could alter the semantics of the query to return more information than intended by the site authors. Real DB applications will use parameterized sql these days.

-- Lee Schumacher, March 9, 2005
Add a comment | Add a link