Editing Common Gateway Interface (section)

== Deployment ==

A Web server that supports CGI can be configured to interpret a [[Uniform Resource Locator|URL]] that it serves as a reference to a CGI script. A common convention is to have a <code>cgi-bin/</code> [[Directory (computing)|directory]] at the base of the directory tree and treat all executable files within this directory (and no other, for security) as CGI scripts. When a Web browser requests a URL that points to a file within the CGI directory (e.g., <code><nowiki>http://example.com/cgi-bin/printenv.pl/with/additional/path?and=a&query=string</nowiki></code>), then, instead of simply sending that file (<code>/usr/local/apache/htdocs/cgi-bin/printenv.pl</code>) to the Web browser, the HTTP server runs the specified script and passes the output of the script to the Web browser. That is, anything that the script sends to [[standard output]] is passed to the Web client instead of being shown in the terminal window that started the web server. Another popular convention is to use [[filename extension]]s; for instance, if CGI scripts are consistently given the extension <code>.cgi</code>, the Web server can be configured to interpret all such files as CGI scripts. While convenient, and required by many prepackaged scripts, it opens the server to attack if a remote user can upload executable code with the proper extension.

The CGI specification defines how additional information passed with the request is passed to the script. The Web server creates a subset of the [[environment variable]]s passed to it and adds details pertinent to the HTTP environment. For instance, if a slash and additional directory name(s) are appended to the URL immediately after the name of the script (in this example, <code>/with/additional/path</code>), then that path is stored in the <code>PATH_INFO</code> [[environment variable]] before the script is called. If parameters are sent to the script via an [[HTTP GET]] request (a question mark appended to the URL, followed by param=value pairs; in the example, <code>?and=a&query=string</code>), then those parameters are stored in the <code>QUERY_STRING</code> environment variable before the script is called. Request [[HTTP message body]], such as form parameters sent via an [[HTTP POST]] request, are passed to the script's [[standard input]]. The script can then read these environment variables or data from standard input and adapt to the Web browser's request.<ref>{{cite book |last1=Nelson |first1=Anne Fulcher |last2=Nelson |first2=William Harris Morehead |year=2001 |title=Building Electronic Commerce with Web Database Constructions |location=Boston, MA |publisher= Addison Wesley}}</ref>