COMP519 Practical 14 Python (5)

Size: px

Start display at page:

Download "COMP519 Practical 14 Python (5)"

Marshall Day
6 years ago
Views:

1 COMP519 Practical 14 Python (5) Introduction This practical contains further exercises that are intended to familiarise you with Python Programming. While you work through the tasks below compare your results with those of your fellow students and ask for help and comments if required. This document can be found at and you might proceed more quickly if you cut-and-paste code from that PDF file. Note that a cut-and-paste operation may introduce extra spaces into your code. It is important that those are removed and that your code exactly matches that shown in this worksheet. The exercises and instructions in this worksheet assume that you use the Department s Linux systems to experiment with Perl. To keep things simple, we will just use a text editor, a terminal and a web browser. You can use whatever text editor and web browser you are most familiar or comfortable with. If you do not manage to get through all the exercises during this practical session, please complete them in your own time before the next practical takes place. Exercises 1. Let us start by creating a first CGI script using Python. a. Create a directory $HOME/public_html/cgi-bin/ and make sure that public_html and cgi-bin are both readable and executable by everyone using the command chmod -R a+rx $HOME/public_html/ in a terminal. b. Open a text editor and enter the following Python code: #!/usr/bin/python3 # Author: <fill in your name> # My first CGI Python script. import cgi, cgitb, os, re, sys, codecs, urllib.request sys.stdout = codecs.getwriter("utf-8")(sys.stdout.detach()) cgitb.enable() Content-type: text/html <!DOCTYPE html> <html> <head> 1

2 <meta charset="utf-8"> <title>cgi Python Script</title> </head> <body> ) print( <section>\n<h1>environment Variables</h1> ) print( <table>\n<tbody> ) for k in sorted(os.environ.keys()): print("<tr><th>" + k + " </th><td> " + os.environ[k] + "</td></tr>") print( </tbody>\n</table>\n<p></p>\n</section> ) # Code for Exercice 1g here print( </body>\n</html> ) c. Save the code to a file named python14a.py in $HOME/public_html/cgi-bin/. d. Open a terminal, go to the directory in which the file has been stored, make the file python14a.py executable for everyone, but only readable and writable by yourself, using chmod a+x,og-rw python14a.py and execute the Python script using the command./python14a.py Check that there are no syntax errors and that the script produces some output. This should become standard practice for you. CGI scripts that contain syntax errors produce no meaningful output or error messages when accessed using a web browser (as we will do in exercise 1e). So, always assure yourself first that there are no syntax errors before accessing one of your scripts via the web. e. Now open a web browser and access the URL where <user> is your user name. f. Make sure that both exercise 1c and 1e produce output. Compare the output. Why do exercise 1c and 1e produce different output? g. At the point Code for Exercise 1g here in python14a.py insert the following code: print( <section>\n<h1>cgi Form Data</h1> ) inputs = cgi.fieldstorage() for name in inputs.keys(): print( Name:,name, getvalue:,inputs.getvalue(name), <br> ) print( Name:,name, getfirst:,inputs.getfirst(name), <br> ) print( Name:,name, getlist :,inputs.getlist(name), <br> ) print( </section>\n<section>\n<h1>form</h1> ) <form action="" method="get"> <label>enter your user name: <input type="text" name="username"></label><br> <label>enter your full name: <input type="text" name="fullname"></label><br> <input type="submit" value="click for response"> </form></section> ) 2

3 h. Save the changes and execute the script on the command line. Make sure that there are no syntax errors. Then reload your the script in the web browser. You should see that the section for the CGI Form Data is empty while there is now a form with two text fields at the end of the page. i. Enter you own user name and press the submit button. You should now see information in the CGI Form Data section of the page. Also, look for the QUERY_STRING entry in the Environment Variables section and see what its value is. Finally, note how the URL in the URL/Search field of your browser has changed. Test the script with various names. In particular, try names like Catherine O Donnell and Jürgen Klopp and observe how they are encoded and decoded. Finally, perform a test where you leave both fields empty and just click on the submit button. Take a note of the values of the environment variables REQUEST_METHOD and QUERY_STRING as well as the CGI Form Data in this situation. j. Currently, our form uses the request method GET. Change the code of the script so that the request method POST is used. The repeat the test that you have performed in Exercise 1i. Again, for the final test where you leave both fields empty and just click on the submit button, take a note of the values of the environment variables REQUEST_METHOD and QUERY_STRING as well as the CGI Form Data. 2. In the previous exercise you have seen that we can use the same script to generate a form and to process input from that form. But typically we would not expect that form to be still present during the processing stage. It should instead disappear and only the output of the processing stage should be shown. However, if we want to achieve this, we are faced with a problem: How do we distingush the situation where the user accesses our script for the first time from the situation where the user has submitted the form but left both text fields empty? a. Make a copy of python14a.py called python14b.py in the same directory. Move the code that outputs the section with the HTML form to a function formoutput. Add a call of formoutput where that code originally was. b. Modify python14b.py so that the HTML markup for the form is no longer produces if the user has submitted form data, even if the user left both text fields empty. c. Add a check whether the user has left one or both text fields empty when submitting the form. If so, an error message should be shown and the user is also shown the HTML form so that another attempt at completing the form can be made. d. All the print statements that refer to the form data are susceptible to cross-site scripting: Printing out inputs[name].value etc incorporates whatever the user has entered into the text field of the form. We should either validate that this is not the case before printing out inputs[name].value or be more careful with the way we print the user s input. Read up on the function html.escape of the html module at and the function cgi.escape of the cgi module at Neither of these two functions is perfect, but can be used as a starting point. Write your own function escapehtml that convert the characters &, <, >,, and in a given string to HTML-safe sequences and also converts newlines and spaces into appropriate HTML markup. 3

4 e. Modify the script so that only requests that come from a PC within the department (or the university) are answered. All other requests should result in an empty HTML page or an error message. f. Modify the script so that users of Microsoft Internet Explorer will receive the message Change to a better browser instead of the HTML form page. Hint: Take a look at to see what values the environment variable HTTP_USER_AGENT might take for various versions of Microsoft Internet Explorer. g. Modify the script so that the user can use the HTML form to indicate which degree programme he/she is studying (among the programmes CSAD, CSBD, CSCI, and CSMS). Use radio buttons to do so. Test your code and observe how data from radio buttons is handled by cgi.fieldstorage(). h. Modify the script so that the user can use the HTML form to indicate which modules he/she is studying (among the modules COMP516, COMP517, COMP518, and COMP519). Use checkboxes to do so. Test your code and observe how data from checkboxed is handled by cgi.fieldstorage(). i. Modify the script so that a count is kept that is increased with each consecutive call of the page and displayed on the results page. Hint: A hidden field might be the easiest way of doing this. 3. Let us move on to a slightly more complicated CGI script. a. Open a text editor and enter the following Python code: #!/usr/bin/python3 # Author: <fill in your name> # My third CGI Python script. import cgi, cgitb, os, re, sys, codecs, urllib.request sys.stdout = codecs.getwriter("utf-8")(sys.stdout.detach()) cgitb.enable() Content-type: text/html <!DOCTYPE html> <html> <head> <meta charset="utf-8"> <title>cgi Python Script</title> </head> <body> ) print( <section>\n<h1>environment Variables</h1> ) print( <table>\n<tbody> ) for k in sorted(os.environ.keys()): print("<tr><th>" + k + " </th><td> " + os.environ[k] + "</td></tr>") print( </tbody>\n</table>\n<p></p>\n</section> ) 4

5 print( <section>\n<h1>cgi Form Data</h1> ) inputs = cgi.fieldstorage() for name in inputs.keys(): print( Name:,name, getvalue:,inputs.getvalue(name), <br> ) print( Name:,name, getfirst:,inputs.getfirst(name), <br> ) print( Name:,name, getlist :,inputs.getlist(name), <br> ) print( </section>\n<section>\n<h1>form</h1> ) <form action="" method="post"> <label>url: <input type="text" name="url" size="100"></label><br> <input type="submit" value="analyse"> </form></section> ) text = "" if URL in inputs: print( <section><h1>analysis of +inputs.getfirst( URL )+ </h1> ) # Retrieve URL here and assign it to text print(text) print( </section> ) print( </body>\n</html> ) b. Save the code to a file named python14c.py in $HOME/public_html/cgi-bin/. c. Open a terminal, go to the directory in which the file has been stored, make the file python14c.py executable for everyone, but only readable and writable by yourself. Check that there are no syntax errors and that the script produces HTML markup as output. d. At the point # Retrieve URL here and assign it to text add code to the script that uses the urlopen function of the urllib.request to retrieve the URL entered via the form and stores the retrieved document in the variable text. e. Now open a web browser and access the URL where <user> is your user name. You should see an HTML form that allows you to enter a URL. f. Enter the URL below into the textfield of the form and press the submit button. You should now be shown a different page that displays the values of environment variables and parameters as well as the contents of the document available at the URL above, and the same HTML form at the bottom of the page. g. The text stored in text obviously contains HTML markup. Modify the line print(text) in the script so that the content of $text is shown verbatim, including the HTML markup. Reuse the function that you have written in Exercise 2d. h. Add code to the script that extracts the names from text and stores them in an array names. i. Add the following code to the script, right after the code you have created in Exercise 3h. 5

6 count = {}; for name in names: if name in count: count[name] += 1 else: count[name] = 1 for key in count.keys(): print(key,": ",count[key],"<br>") j. Make sure that exercises 3h and 3i lead to the correct result for the URL in 3f. k. Modify the code in 3i so that the output produced by the second for-loop is a twodimensional HTML table of the form below. Ideally the names are sorted according the number of occurrences from highest to lowest. Name count Name No of occurrences Andreas Schoknecht 4 Torsten Ullrich 3. Hint: Use the sorted function to sort the list of keys of count according the values stored in count. 6

COMP284 Practical 3 Perl (3)

COMP284 Practical 3 Perl (3) Introduction This practical contains further exercises that are intended to familiarise you with Perl Programming. While you work through the tasks below compare your results