CGI (Common Gateway Interface)

One of the request types which may be sent to a Web server is a request to execute a CGI script. In plain terms, this is a request for the server to execute a program on the computer which hosts the server. A call to a CGI program is encoded into a HTML document, where it usually appears as a hyperlink. Clicking on the link executes the CGI program on the Web server. Using CGI means that it will pass parameters to the program in a specific way. When this type of request is sent, the program requested is launched by the server, using the parameters passed as part of the request, and the output from the program is then sent back to the client. Whatever is returned must be formatted as HTML, and this is one of the key functions of a CGI program.

The most common way of interacting with databases over the Internet is through the CGI. The CGI is independent of the underlying database. CGI programs can receive parameters, and most return results that may consist of text (a status message at the very least), graphics, or both. The CGI 'script' may be an actual script or batch file, or any other program, including Visual Basic programs.

This CGI capability makes it possible to use the HTTP protocol over any TCP/IP network, either the public Internet or a private network, useful for client/server processing of almost any kind.

PERL (Practical Extraction and Report Language) has been a favorite language for CGI programs because it is heavily laden with string-handling features, and it is commonly found in UNIX environments where Web servers originated. However, a number of recent products enable developers to use other languages like Visual Basic, and they run on Windows NT and Windows 95 based Web servers. Several Web database integration products also promise to shield developers from the low level details of writing CGI programs.

Challenges in CGI database applications

There are three fundamental problems with deploying a standard CGI based database application:

• Excessive resource consumption. A typical CGI program is a relatively large (sometimes > 500K) executable program that is started by the web server, makes a connection to the ODBC data source, performs the query, and then terminates. In a high-concurrence environment, you can see the problems this can cause.
• Connections are not persistent. Re-connecting to the data source on each new request. The CGI program should maintain a pool of connections, sharing, creating, and dropping them as necessary to service incoming requests. Pool and re-use connections maximize performance and minimize re-connection overhead.
• No state information is maintained. This is particularly problematic if you are working with a secure database. In a typical client-server environment, an application makes a connection to the data source, passing the user name and password for validation. The application then uses that connection for the duration of the user session. CGI programs that execute in a monolithic manner must store state information in pages that are passed back and forth between the server and browser, which is a real security problem since anyone could browse a cached page and look at a user's database name and password. In addition, the CGI program would have to connect again and again for each user query.

A properly engineered CGI program should prompt the user using the secure login dialog provided by your web browser, make a connection to the database, and use that connection for each subsequent query. This eliminates the overhead of reconnecting each time and reduces the possibility of security breaches.

Many vendors have built gateways that address the above deficiencies.

Other Gateway Interfaces

ISAPI Internet Server Applications (ISA). ISAs are dynamic-link libraries (DLLs) that are similar to CGI scripts. ISAs are loaded in the same address space of the HTTP server--unlike CGI, which creates a separate process for every request. This creates a back-end scripting solution that is higher performance than CGI and consumes far less RAM.

ISAPI HTTP Server Filters. An HTTP filter is a replaceable DLL that the server calls on every HTTP request. When the filter is loaded, it tells the server what sort of notifications it is interested in. After that, whenever the selected events occur, the filter is called and given the opportunity to process that event.

ISAPI Internet Database Connector. This allows Web browsers ODBC (open database connectivity) database access for HTTP requests. Developers can use this feature to create Web pages with information from the database; to insert, update, and delete information in the database based on user input; and to perform other SQL commands.

Back to The Technology Homepage

Return to The Homepage