[snip]
in short, you want to know how form arguments get passed to cgi's.
it's done through the environmental variable QUERY_STRING for GET
requests, and through standard input for POST (with the length passed
in CONTENT_LENGTH). it's encoded as name=value&name=value&... and in
name and value, all non alphanumeric characters are replaced with %XX
where XX is their hex code. interpreting this string is not easy in
straight sh or bash. I use a gawk script of my own devising
(available at http://andru.sonoma.edu/~luvisi/) called cgiparse.awk.
you can also use cgiparse from w3c (you have to download the whole
cern server to get it, and it's in C and has to be compiled) at
http://www.w3.org/ . You can also check out Un-cgi at
http://www.hyperion.com/~koreth/uncgi.html which is another C program
which decodes form arguments to make writing sh cgi's easier. I'll
explain how to do this using cgiparse.awk... for info on the others,
check their pages. also, if anyone knows of any other resources of
this type, let me know.
cgiparse.awk works by returning a string you can eval in a shell
script in order to assign all the form arguments into environmental
variables of the form FORM_<name> (where <name> is the name of the
form argument). so, to use it, you put:
eval `cgiparse.awk`
near the top of your sh cgi.
then, presuming you used the name "SONGSEARCH" for the form argument,
whenever you want to know what the user entered in that field, you use
$FORM_SONGSEARCH in the sh script.
so far so good.Quote:> Begin BASH code
> ~~~~~~~~~~~~~~~~~~~~~~
> #!/bin/bash
> echo 'Content-type: text/html'
> echo
replace this with:Quote:> # Is this the correct way to receive the string from the HTML doc?
> # "SONGSEARCH" should be the string that Im searching for.
> read SONGSEARCH
eval `cgiparse.awk`
^^^^^^^^^^^Quote:> a=0
> numofsongs=`grep -li $SONGSEARCH public_html/lyrics/*.html | wc -l`
use $FORM_SONGSEARCH, and PUT IT IN QUOTES! you don't want anyone
putting ; or | in there and making your script do random things, do you?
numofsongs=`grep -li "$FORM_SONGSEARCH" public_html/lyrics/*.html | wc -l`
again, put it in quotes...Quote:> ### SNIP BASH SCRIPT###
> if [ $numofsongs -gt 0 ]
> then
> cat search_hdr.txt
> echo '<H2>Your search for ' \"$SONGSEARCH\" ' yielded '$numofsongs'
echo '<H2>Your search for ' \""$FORM_SONGSEARCH"\" ' yielded '$numofsongs'
and here...Quote:> songs.</H2>'
> echo '<BR>'
> echo '<BR>'
> for i in public_html/lyrics/*.html
> do
> songname=`grep -li $SONGSEARCH $i | cut -c 20-`
songname=`grep -li "$FORM_SONGSEARCH" $i | cut -c 20-`
and since songname contains "tainted" data, you'll want to quoteQuote:> grep -ih $songname public_html/alpha/*.html
$songname too...
grep -ih "$songname" public_html/alpha/*.html
the form looks good to me...Quote:> done
> cat search_ftr.txt
> ### SNIP BASH SCRIPT###
> fi
> exit 0
> ~~~~~~~~~~~~~~~~~~~~~~
> End BASH code
> ~~~~~~~~~~~~~~~~~~~~~~
> ~~~~~~~~~~~~~~~~~~~~~~
> Begin HTML code
> ~~~~~~~~~~~~~~~~~~~~~~
> ### SNIP HTML FILE###
> <FORM Method="get" Action="/home/jrr/april/findbob.cgi">
> <CENTER>
> <B>Search Function</B>
> </CENTER>
> <BR>
> Enter your search string:
> <CENTER><INPUT TYPE="text" Size=30 Name="SONGSEARCH">
> </CENTER>
> <BR>
> <CENTER>
> <INPUT TYPE=submit Size=40 VALUE="Search">
> <INPUT TYPE=reset Size=40 VALUE="Reset">
> </CENTER>
> </FORM>
best of luck,
andru