Re: CGI/1.1 draft (Rob McCool)
Date: Thu, 17 Mar 1994 15:28:30 --100
Message-id: <>
Precedence: bulk
From: (Rob McCool)
To: Multiple recipients of list <>
Subject: Re: CGI/1.1 draft
X-Listprocessor-Version: 6.0c -- ListProcessor by Anastasios Kotsikonas
Content-Length: 1621
 * Re: CGI/1.1 draft  by George Phillips  (Tel (604)-822-4230)
 *    written on Mar 16,  1:23pm.
 * >I don't agree. I think that with dummy inputs available in forms, we can
 * >finally move away from using PATH_INFO to convey state information to
 * >scripts and go back to using them for their intended purpose: To allow
 * >scripts to access the server's virtual->physical translation and access
 * >authorization for auxillary files. If you're using filenames in PATH_INFO
 * >then you don't have to escape the information, and if you have it as dummy
 * >inputs in a form then your data is already escaped anyway.
 * I agree that PATH_INFO is not the right place for user input, but
 * PATH_INFO is something generated by the script for use by the script.
 * The server shouldn't be touching it.  It shouldn't even have any
 * idea if % or some other escaping is done on the information there.
 * As long as there are no bad characters in it, it just doesn't matter.

But it does touch it... it has to make PATH_TRANSLATED.

 * I certainly don't agree with your idea of the intended purpose of
 * CGI scripts.  I use them all the time for dynamically translating
 * data into browser-understandable formats (like HTML).  Input
 * forms and searches are just one possible use.

I didn't say anything about the purpose of CGI scripts. I said something
about the intended purpose of PATH_INFO. I use CGI for much more than forms
too, and in the future these other uses will become very important. I just
don't think that having binary data in PATH_INFO is either a good idea or
a necessary action.