python-doc-tw.github.io/library/cgi.html at master · python-doc-tw/python-doc-tw.github.io

History

667 lines (633 loc) · 55.1 KB

Raw

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300

301

302

303

304

305

306

307

308

309

310

311

312

313

314

315

316

317

318

319

320

321

322

323

324

325

326

327

328

329

330

331

332

333

334

335

336

337

338

339

340

341

342

343

344

345

346

347

348

349

350

351

352

353

354

355

356

357

358

359

360

361

362

363

364

365

366

367

368

369

370

371

372

373

374

375

376

377

378

379

380

381

382

383

384

385

386

387

388

389

390

391

392

393

394

395

396

397

398

399

400

401

402

403

404

405

406

407

408

409

410

411

412

413

414

415

416

417

418

419

420

421

422

423

424

425

426

427

428

429

430

431

432

433

434

435

436

437

438

439

440

441

442

443

444

445

446

447

448

449

450

451

452

453

454

455

456

457

458

459

460

461

462

463

464

465

466

467

468

469

470

471

472

473

474

475

476

477

478

479

480

481

482

483

484

485

486

487

488

489

490

491

492

493

494

495

496

497

498

499

500

501

502

503

504

505

506

507

508

509

510

511

512

513

514

515

516

517

518

519

520

521

522

523

524

525

526

527

528

529

530

531

532

533

534

535

536

537

538

539

540

541

542

543

544

545

546

547

548

549

550

551

552

553

554

555

556

557

558

559

560

561

562

563

564

565

566

567

568

569

570

571

572

573

574

575

576

577

578

579

580

581

582

583

584

585

586

587

588

589

590

591

592

593

594

595

596

597

598

599

600

601

602

603

604

605

606

607

608

609

610

611

612

613

614

615

616

617

618

619

620

621

622

623

624

625

626

627

628

629

630

631

632

633

634

635

636

637

638

639

640

641

642

643

644

645

646

647

648

649

650

651

652

653

654

655

656

657

658

659

660

661

662

663

664

665

666

667

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"

"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<head>

<title>22.2. cgi — Common Gateway Interface support — Python 3.7.0 說明文件</title>

title="在 Python 3.7.0 說明文件中搜尋"

href="../_static/opensearch.xml"/>

</head><body>

<ul>

<a href="../genindex.html" title="General Index"

accesskey="I">索引</a></li>

<a href="../py-modindex.html" title="Python 模組索引"

>模組</a> |</li>

<a href="cgitb.html" title="22.3. cgitb — Traceback manager for CGI scripts"

accesskey="N">下一頁</a> |</li>

<a href="webbrowser.html" title="22.1. webbrowser — Convenient Web-browser controller"

accesskey="P">上一頁</a> |</li>

<li><img src="../_static/py.png" alt=""

style="vertical-align: middle; margin-top: -1px"/></li>

<li><a href="https://www.python.org/">Python</a> »</li>

<li>

zh_TW

3.7.0

<a href="../index.html">Documentation </a> »

</li>

<li class="nav-item nav-item-1"><a href="index.html" >Python 標準函式庫 (Standard Library)</a> »</li>

<li class="nav-item nav-item-2"><a href="internet.html" accesskey="U">22. Internet Protocols and Support</a> »</li>

</form>

</div>

</li>

</ul>

</div>

<h1>22.2. <a class="reference internal" href="#module-cgi" title="cgi: Helpers for running Python scripts via the Common Gateway Interface."><code class="xref py py-mod docutils literal notranslate">cgi</code></a> — Common Gateway Interface support<a class="headerlink" href="#module-cgi" title="本標題的永久連結">¶</a></h1>

Source code: <a class="reference external" href="https://github.com/python/cpython/tree/3.7/Lib/cgi.py">Lib/cgi.py</a>

Support module for Common Gateway Interface (CGI) scripts.

This module defines a number of utilities for use by CGI scripts written in

Python.

A CGI script is invoked by an HTTP server, usually to process user input

submitted through an HTML <code class="docutils literal notranslate"><FORM></code> or <code class="docutils literal notranslate"><ISINDEX></code> element.

Most often, CGI scripts live in the server’s special <code class="file docutils literal notranslate">cgi-bin</code> directory.

The HTTP server places all sorts of information about the request (such as the

client’s hostname, the requested URL, the query string, and lots of other

goodies) in the script’s shell environment, executes the script, and sends the

script’s output back to the client.

The script’s input is connected to the client too, and sometimes the form data

is read this way; at other times the form data is passed via the 「query string」

part of the URL. This module is intended to take care of the different cases

and provide a simpler interface to the Python script. It also provides a number

of utilities that help in debugging scripts, and the latest addition is support

for file uploads from a form (if your browser supports it).

The output of a CGI script should consist of two sections, separated by a blank

line. The first section contains a number of headers, telling the client what

kind of data is following. Python code to generate a minimal header section

looks like this:

<div class="highlight-python3 notranslate"><div class="highlight"><pre>print("Content-Type: text/html") # HTML is following

print() # blank line, end of headers

</pre></div>

</div>

The second section is usually HTML, which allows the client software to display

nicely formatted text with header, in-line images, etc. Here’s Python code that

prints a simple piece of HTML:

<div class="highlight-python3 notranslate"><div class="highlight"><pre>print("<TITLE>CGI script output</TITLE>")

print("<H1>This is my first CGI script</H1>")

print("Hello, world!")

</pre></div>

</div>

<h2>22.2.2. Using the cgi module<a class="headerlink" href="#using-the-cgi-module" title="本標題的永久連結">¶</a></h2>

Begin by writing <code class="docutils literal notranslate">import cgi</code>.

When you write a new script, consider adding these lines:

<div class="highlight-python3 notranslate"><div class="highlight"><pre>import cgitb

cgitb.enable()

</pre></div>

</div>

This activates a special exception handler that will display detailed reports in

the Web browser if any errors occur. If you’d rather not show the guts of your

program to users of your script, you can have the reports saved to files

instead, with code like this:

<div class="highlight-python3 notranslate"><div class="highlight"><pre>import cgitb

cgitb.enable(display=0, logdir="/path/to/logdir")

</pre></div>

</div>

It’s very helpful to use this feature during script development. The reports

produced by <a class="reference internal" href="cgitb.html#module-cgitb" title="cgitb: Configurable traceback handler for CGI scripts."><code class="xref py py-mod docutils literal notranslate">cgitb</code></a> provide information that can save you a lot of time in

tracking down bugs. You can always remove the <code class="docutils literal notranslate">cgitb</code> line later when you

have tested your script and are confident that it works correctly.

To get at submitted form data, use the <code class="xref py py-class docutils literal notranslate">FieldStorage</code> class. If the form

contains non-ASCII characters, use the encoding keyword parameter set to the

value of the encoding defined for the document. It is usually contained in the

META tag in the HEAD section of the HTML document or by the

Content-Type header). This reads the form contents from the

standard input or the environment (depending on the value of various

environment variables set according to the CGI standard). Since it may consume

standard input, it should be instantiated only once.

The <code class="xref py py-class docutils literal notranslate">FieldStorage</code> instance can be indexed like a Python dictionary.

It allows membership testing with the <a class="reference internal" href="../reference/expressions.html#in"><code class="xref std std-keyword docutils literal notranslate">in</code></a> operator, and also supports

the standard dictionary method <a class="reference internal" href="stdtypes.html#dict.keys" title="dict.keys"><code class="xref py py-meth docutils literal notranslate">keys()</code></a> and the built-in function

<a class="reference internal" href="functions.html#len" title="len"><code class="xref py py-func docutils literal notranslate">len()</code></a>. Form fields containing empty strings are ignored and do not appear

in the dictionary; to keep such values, provide a true value for the optional

keep_blank_values keyword parameter when creating the <code class="xref py py-class docutils literal notranslate">FieldStorage</code>

instance.

For instance, the following code (which assumes that the

Content-Type header and blank line have already been printed)

checks that the fields <code class="docutils literal notranslate">name</code> and <code class="docutils literal notranslate">addr</code> are both set to a non-empty

string:

<div class="highlight-python3 notranslate"><div class="highlight"><pre>form = cgi.FieldStorage()

if "name" not in form or "addr" not in form:

print("<H1>Error</H1>")

print("Please fill in the name and addr fields.")

return

print("name:", form["name"].value)

print("addr:", form["addr"].value)

...further form processing here...

</pre></div>

</div>

Here the fields, accessed through <code class="docutils literal notranslate">form[key]</code>, are themselves instances of

<code class="xref py py-class docutils literal notranslate">FieldStorage</code> (or <code class="xref py py-class docutils literal notranslate">MiniFieldStorage</code>, depending on the form

encoding). The <code class="xref py py-attr docutils literal notranslate">value</code> attribute of the instance yields

the string value of the field. The <code class="xref py py-meth docutils literal notranslate">getvalue()</code> method

returns this string value directly; it also accepts an optional second argument

as a default to return if the requested key is not present.

If the submitted form data contains more than one field with the same name, the

object retrieved by <code class="docutils literal notranslate">form[key]</code> is not a <code class="xref py py-class docutils literal notranslate">FieldStorage</code> or

<code class="xref py py-class docutils literal notranslate">MiniFieldStorage</code> instance but a list of such instances. Similarly, in

this situation, <code class="docutils literal notranslate">form.getvalue(key)</code> would return a list of strings. If you

expect this possibility (when your HTML form contains multiple fields with the

same name), use the <a class="reference internal" href="#cgi.FieldStorage.getlist" title="cgi.FieldStorage.getlist"><code class="xref py py-meth docutils literal notranslate">getlist()</code></a> method, which always returns

a list of values (so that you do not need to special-case the single item

case). For example, this code concatenates any number of username fields,

separated by commas:

<div class="highlight-python3 notranslate"><div class="highlight"><pre>value = form.getlist("username")

usernames = ",".join(value)

</pre></div>

</div>

If a field represents an uploaded file, accessing the value via the

<code class="xref py py-attr docutils literal notranslate">value</code> attribute or the <code class="xref py py-meth docutils literal notranslate">getvalue()</code>

method reads the entire file in memory as bytes. This may not be what you

want. You can test for an uploaded file by testing either the

<code class="xref py py-attr docutils literal notranslate">filename</code> attribute or the <code class="xref py py-attr docutils literal notranslate">file</code>

attribute. You can then read the data from the <code class="xref py py-attr docutils literal notranslate">file</code>

attribute before it is automatically closed as part of the garbage collection of

the <code class="xref py py-class docutils literal notranslate">FieldStorage</code> instance

(the <a class="reference internal" href="io.html#io.RawIOBase.read" title="io.RawIOBase.read"><code class="xref py py-func docutils literal notranslate">read()</code></a> and <a class="reference internal" href="io.html#io.IOBase.readline" title="io.IOBase.readline"><code class="xref py py-func docutils literal notranslate">readline()</code></a> methods will

return bytes):

<div class="highlight-python3 notranslate"><div class="highlight"><pre>fileitem = form["userfile"]

if fileitem.file:

# It's an uploaded file; count lines

linecount = 0

while True:

line = fileitem.file.readline()

if not line: break

linecount = linecount + 1

</pre></div>

</div>

<code class="xref py py-class docutils literal notranslate">FieldStorage</code> objects also support being used in a <a class="reference internal" href="../reference/compound_stmts.html#with"><code class="xref std std-keyword docutils literal notranslate">with</code></a>

statement, which will automatically close them when done.

If an error is encountered when obtaining the contents of an uploaded file

(for example, when the user interrupts the form submission by clicking on

a Back or Cancel button) the <code class="xref py py-attr docutils literal notranslate">done</code> attribute of the

object for the field will be set to the value -1.

The file upload draft standard entertains the possibility of uploading multiple

files from one field (using a recursive multipart/* encoding).

When this occurs, the item will be a dictionary-like <code class="xref py py-class docutils literal notranslate">FieldStorage</code> item.

This can be determined by testing its <code class="xref py py-attr docutils literal notranslate">type</code> attribute, which should be

multipart/form-data (or perhaps another MIME type matching

multipart/*). In this case, it can be iterated over recursively

just like the top-level form object.

When a form is submitted in the 「old」 format (as the query string or as a single

data part of type application/x-www-form-urlencoded), the items will

actually be instances of the class <code class="xref py py-class docutils literal notranslate">MiniFieldStorage</code>. In this case, the

<code class="xref py py-attr docutils literal notranslate">list</code>, <code class="xref py py-attr docutils literal notranslate">file</code>, and <code class="xref py py-attr docutils literal notranslate">filename</code> attributes are always <code class="docutils literal notranslate">None</code>.

A form submitted via POST that also has a query string will contain both

<code class="xref py py-class docutils literal notranslate">FieldStorage</code> and <code class="xref py py-class docutils literal notranslate">MiniFieldStorage</code> items.

3.4 版更變: The <code class="xref py py-attr docutils literal notranslate">file</code> attribute is automatically closed upon the

garbage collection of the creating <code class="xref py py-class docutils literal notranslate">FieldStorage</code> instance.

</div>

3.5 版更變: Added support for the context management protocol to the

<code class="xref py py-class docutils literal notranslate">FieldStorage</code> class.

</div>

<h2>22.2.3. Higher Level Interface<a class="headerlink" href="#higher-level-interface" title="本標題的永久連結">¶</a></h2>

The previous section explains how to read CGI form data using the

<code class="xref py py-class docutils literal notranslate">FieldStorage</code> class. This section describes a higher level interface

which was added to this class to allow one to do it in a more readable and

intuitive way. The interface doesn’t make the techniques described in previous

sections obsolete — they are still useful to process file uploads efficiently,

for example.

The interface consists of two simple methods. Using the methods you can process

form data in a generic way, without the need to worry whether only one or more

values were posted under one name.

In the previous section, you learned to write following code anytime you

expected a user to post more than one value under one name:

<div class="highlight-python3 notranslate"><div class="highlight"><pre>item = form.getvalue("item")

if isinstance(item, list):

# The user is requesting more than one item.

else:

# The user is requesting only one item.

</pre></div>

</div>

This situation is common for example when a form contains a group of multiple

checkboxes with the same name:

</pre></div>

</div>

In most situations, however, there’s only one form control with a particular

name in a form and then you expect and need only one value associated with this

name. So you write a script containing for example this code:

<div class="highlight-python3 notranslate"><div class="highlight"><pre>user = form.getvalue("user").upper()

</pre></div>

</div>

The problem with the code is that you should never expect that a client will

provide valid input to your scripts. For example, if a curious user appends

another <code class="docutils literal notranslate">user=foo</code> pair to the query string, then the script would crash,

because in this situation the <code class="docutils literal notranslate">getvalue("user")</code> method call returns a list

instead of a string. Calling the <a class="reference internal" href="stdtypes.html#str.upper" title="str.upper"><code class="xref py py-meth docutils literal notranslate">upper()</code></a> method on a list is not valid

(since lists do not have a method of this name) and results in an

<a class="reference internal" href="exceptions.html#AttributeError" title="AttributeError"><code class="xref py py-exc docutils literal notranslate">AttributeError</code></a> exception.

Therefore, the appropriate way to read form data values was to always use the

code which checks whether the obtained value is a single value or a list of

values. That’s annoying and leads to less readable scripts.

A more convenient approach is to use the methods <a class="reference internal" href="#cgi.FieldStorage.getfirst" title="cgi.FieldStorage.getfirst"><code class="xref py py-meth docutils literal notranslate">getfirst()</code></a>

and <a class="reference internal" href="#cgi.FieldStorage.getlist" title="cgi.FieldStorage.getlist"><code class="xref py py-meth docutils literal notranslate">getlist()</code></a> provided by this higher level interface.

<code class="descclassname">FieldStorage.</code><code class="descname">getfirst</code>(name, default=None)<a class="headerlink" href="#cgi.FieldStorage.getfirst" title="本定義的永久連結">¶</a></dt>

<dd>This method always returns only one value associated with form field name.

The method returns only the first value in case that more values were posted

under such name. Please note that the order in which the values are received

may vary from browser to browser and should not be counted on. <a class="footnote-reference" href="#id3" id="id2">[1]</a> If no such

form field or value exists then the method returns the value specified by the

optional parameter default. This parameter defaults to <code class="docutils literal notranslate">None</code> if not

specified.

</dd></dl>

<code class="descclassname">FieldStorage.</code><code class="descname">getlist</code>(name)<a class="headerlink" href="#cgi.FieldStorage.getlist" title="本定義的永久連結">¶</a></dt>

<dd>This method always returns a list of values associated with form field name.

The method returns an empty list if no such form field or value exists for

name. It returns a list consisting of one item if only one such value exists.

</dd></dl>

Using these methods you can write nice compact code:

<div class="highlight-python3 notranslate"><div class="highlight"><pre>import cgi

form = cgi.FieldStorage()

user = form.getfirst("user", "").upper() # This way it's safe.

for item in form.getlist("item"):

do_something(item)

</pre></div>

</div>

<h2>22.2.4. Functions<a class="headerlink" href="#functions" title="本標題的永久連結">¶</a></h2>

These are useful if you want more control, or if you want to employ some of the

algorithms implemented in this module in other circumstances.

<code class="descclassname">cgi.</code><code class="descname">parse</code>(fp=None, environ=os.environ, keep_blank_values=False, strict_parsing=False)<a class="headerlink" href="#cgi.parse" title="本定義的永久連結">¶</a></dt>

<dd>Parse a query in the environment or from a file (the file defaults to

<code class="docutils literal notranslate">sys.stdin</code>). The keep_blank_values and strict_parsing parameters are

passed to <a class="reference internal" href="urllib.parse.html#urllib.parse.parse_qs" title="urllib.parse.parse_qs"><code class="xref py py-func docutils literal notranslate">urllib.parse.parse_qs()</code></a> unchanged.

</dd></dl>

<code class="descclassname">cgi.</code><code class="descname">parse_qs</code>(qs, keep_blank_values=False, strict_parsing=False)<a class="headerlink" href="#cgi.parse_qs" title="本定義的永久連結">¶</a></dt>

<dd>This function is deprecated in this module. Use <a class="reference internal" href="urllib.parse.html#urllib.parse.parse_qs" title="urllib.parse.parse_qs"><code class="xref py py-func docutils literal notranslate">urllib.parse.parse_qs()</code></a>

instead. It is maintained here only for backward compatibility.

</dd></dl>

<code class="descclassname">cgi.</code><code class="descname">parse_qsl</code>(qs, keep_blank_values=False, strict_parsing=False)<a class="headerlink" href="#cgi.parse_qsl" title="本定義的永久連結">¶</a></dt>

<dd>This function is deprecated in this module. Use <a class="reference internal" href="urllib.parse.html#urllib.parse.parse_qsl" title="urllib.parse.parse_qsl"><code class="xref py py-func docutils literal notranslate">urllib.parse.parse_qsl()</code></a>

instead. It is maintained here only for backward compatibility.

</dd></dl>

<code class="descclassname">cgi.</code><code class="descname">parse_multipart</code>(fp, pdict, encoding="utf-8", errors="replace")<a class="headerlink" href="#cgi.parse_multipart" title="本定義的永久連結">¶</a></dt>

<dd>Parse input of type multipart/form-data (for file uploads).

Arguments are fp for the input file, pdict for a dictionary containing

other parameters in the Content-Type header, and encoding,

the request encoding.

Returns a dictionary just like <a class="reference internal" href="urllib.parse.html#urllib.parse.parse_qs" title="urllib.parse.parse_qs"><code class="xref py py-func docutils literal notranslate">urllib.parse.parse_qs()</code></a>: keys are the

field names, each value is a list of values for that field. For non-file

fields, the value is a list of strings.

This is easy to use but not much good if you are expecting megabytes to be

uploaded — in that case, use the <code class="xref py py-class docutils literal notranslate">FieldStorage</code> class instead

which is much more flexible.

3.7 版更變: Added the encoding and errors parameters. For non-file fields, the

value is now a list of strings, not bytes.

</div>

</dd></dl>

<code class="descclassname">cgi.</code><code class="descname">parse_header</code>(string)<a class="headerlink" href="#cgi.parse_header" title="本定義的永久連結">¶</a></dt>

<dd>Parse a MIME header (such as Content-Type) into a main value and a

dictionary of parameters.

</dd></dl>

<dd>Robust test CGI script, usable as main program. Writes minimal HTTP headers and

formats all information provided to the script in HTML form.

</dd></dl>

<code class="descclassname">cgi.</code><code class="descname">print_environ</code>()<a class="headerlink" href="#cgi.print_environ" title="本定義的永久連結">¶</a></dt>

<dd>Format the shell environment in HTML.

</dd></dl>

<code class="descclassname">cgi.</code><code class="descname">print_form</code>(form)<a class="headerlink" href="#cgi.print_form" title="本定義的永久連結">¶</a></dt>

<dd>Format a form in HTML.

</dd></dl>

<code class="descclassname">cgi.</code><code class="descname">print_directory</code>()<a class="headerlink" href="#cgi.print_directory" title="本定義的永久連結">¶</a></dt>

<dd>Format the current directory in HTML.

</dd></dl>

<code class="descclassname">cgi.</code><code class="descname">print_environ_usage</code>()<a class="headerlink" href="#cgi.print_environ_usage" title="本定義的永久連結">¶</a></dt>

<dd>Print a list of useful (used by CGI) environment variables in HTML.

</dd></dl>

<code class="descclassname">cgi.</code><code class="descname">escape</code>(s, quote=False)<a class="headerlink" href="#cgi.escape" title="本定義的永久連結">¶</a></dt>

<dd>Convert the characters <code class="docutils literal notranslate">'&'</code>, <code class="docutils literal notranslate">'<'</code> and <code class="docutils literal notranslate">'>'</code> in string s to HTML-safe

sequences. Use this if you need to display text that might contain such

characters in HTML. If the optional flag quote is true, the quotation mark

character (<code class="docutils literal notranslate">"</code>) is also translated; this helps for inclusion in an HTML

attribute value delimited by double quotes, as in <code class="docutils literal notranslate"><a href="..."></code>. Note

that single quotes are never translated.

3.2 版後已棄用: This function is unsafe because quote is false by default, and therefore

deprecated. Use <a class="reference internal" href="html.html#html.escape" title="html.escape"><code class="xref py py-func docutils literal notranslate">html.escape()</code></a> instead.

</div>

</dd></dl>

</div>

<h2>22.2.5. Caring about security<a class="headerlink" href="#caring-about-security" title="本標題的永久連結">¶</a></h2>

There’s one important rule: if you invoke an external program (via the

<a class="reference internal" href="os.html#os.system" title="os.system"><code class="xref py py-func docutils literal notranslate">os.system()</code></a> or <a class="reference internal" href="os.html#os.popen" title="os.popen"><code class="xref py py-func docutils literal notranslate">os.popen()</code></a> functions. or others with similar

functionality), make very sure you don’t pass arbitrary strings received from

the client to the shell. This is a well-known security hole whereby clever

hackers anywhere on the Web can exploit a gullible CGI script to invoke

arbitrary shell commands. Even parts of the URL or field names cannot be

trusted, since the request doesn’t have to come from your form!

To be on the safe side, if you must pass a string gotten from a form to a shell

command, you should make sure the string contains only alphanumeric characters,

dashes, underscores, and periods.

</div>

<h2>22.2.6. Installing your CGI script on a Unix system<a class="headerlink" href="#installing-your-cgi-script-on-a-unix-system" title="本標題的永久連結">¶</a></h2>

Read the documentation for your HTTP server and check with your local system

administrator to find the directory where CGI scripts should be installed;

usually this is in a directory <code class="file docutils literal notranslate">cgi-bin</code> in the server tree.

Make sure that your script is readable and executable by 「others」; the Unix file

mode should be <code class="docutils literal notranslate">0o755</code> octal (use <code class="docutils literal notranslate">chmod 0755 filename</code>). Make sure that the

first line of the script contains <code class="docutils literal notranslate">#!</code> starting in column 1 followed by the

pathname of the Python interpreter, for instance:

<div class="highlight-python3 notranslate"><div class="highlight"><pre>#!/usr/local/bin/python

</pre></div>

</div>

Make sure the Python interpreter exists and is executable by 「others」.

Make sure that any files your script needs to read or write are readable or

writable, respectively, by 「others」 — their mode should be <code class="docutils literal notranslate">0o644</code> for

readable and <code class="docutils literal notranslate">0o666</code> for writable. This is because, for security reasons, the

HTTP server executes your script as user 「nobody」, without any special

privileges. It can only read (write, execute) files that everybody can read

(write, execute). The current directory at execution time is also different (it

is usually the server’s cgi-bin directory) and the set of environment variables

is also different from what you get when you log in. In particular, don’t count

on the shell’s search path for executables (<code class="xref std std-envvar docutils literal notranslate">PATH</code>) or the Python module

search path (<a class="reference internal" href="../using/cmdline.html#envvar-PYTHONPATH"><code class="xref std std-envvar docutils literal notranslate">PYTHONPATH</code></a>) to be set to anything interesting.

If you need to load modules from a directory which is not on Python’s default

module search path, you can change the path in your script, before importing

other modules. For example:

<div class="highlight-python3 notranslate"><div class="highlight"><pre>import sys

sys.path.insert(0, "/usr/home/joe/lib/python")

</pre></div>

</div>

(This way, the directory inserted last will be searched first!)

Instructions for non-Unix systems will vary; check your HTTP server’s

documentation (it will usually have a section on CGI scripts).

</div>

<h2>22.2.7. Testing your CGI script<a class="headerlink" href="#testing-your-cgi-script" title="本標題的永久連結">¶</a></h2>

Unfortunately, a CGI script will generally not run when you try it from the

command line, and a script that works perfectly from the command line may fail

mysteriously when run from the server. There’s one reason why you should still

test your script from the command line: if it contains a syntax error, the

Python interpreter won’t execute it at all, and the HTTP server will most likely

send a cryptic error to the client.

Assuming your script has no syntax errors, yet it does not work, you have no

choice but to read the next section.

</div>

<h2>22.2.8. Debugging CGI scripts<a class="headerlink" href="#debugging-cgi-scripts" title="本標題的永久連結">¶</a></h2>

First of all, check for trivial installation errors — reading the section

above on installing your CGI script carefully can save you a lot of time. If

you wonder whether you have understood the installation procedure correctly, try

installing a copy of this module file (<code class="file docutils literal notranslate">cgi.py</code>) as a CGI script. When

invoked as a script, the file will dump its environment and the contents of the

form in HTML form. Give it the right mode etc, and send it a request. If it’s

installed in the standard <code class="file docutils literal notranslate">cgi-bin</code> directory, it should be possible to

send it a request by entering a URL into your browser of the form:

<div class="highlight-none notranslate"><div class="highlight"><pre>http://yourhostname/cgi-bin/cgi.py?name=Joe+Blow&addr=At+Home

</pre></div>

</div>

If this gives an error of type 404, the server cannot find the script – perhaps

you need to install it in a different directory. If it gives another error,

there’s an installation problem that you should fix before trying to go any

further. If you get a nicely formatted listing of the environment and form

content (in this example, the fields should be listed as 「addr」 with value 「At

Home」 and 「name」 with value 「Joe Blow」), the <code class="file docutils literal notranslate">cgi.py</code> script has been

installed correctly. If you follow the same procedure for your own script, you

should now be able to debug it.

The next step could be to call the <a class="reference internal" href="#module-cgi" title="cgi: Helpers for running Python scripts via the Common Gateway Interface."><code class="xref py py-mod docutils literal notranslate">cgi</code></a> module’s <a class="reference internal" href="test.html#module-test" title="test: Regression tests package containing the testing suite for Python."><code class="xref py py-func docutils literal notranslate">test()</code></a> function

from your script: replace its main code with the single statement

<div class="highlight-python3 notranslate"><div class="highlight"><pre>cgi.test()

</pre></div>

</div>

This should produce the same results as those gotten from installing the

<code class="file docutils literal notranslate">cgi.py</code> file itself.

When an ordinary Python script raises an unhandled exception (for whatever

reason: of a typo in a module name, a file that can’t be opened, etc.), the

Python interpreter prints a nice traceback and exits. While the Python

interpreter will still do this when your CGI script raises an exception, most

likely the traceback will end up in one of the HTTP server’s log files, or be

discarded altogether.

Fortunately, once you have managed to get your script to execute some code,

you can easily send tracebacks to the Web browser using the <a class="reference internal" href="cgitb.html#module-cgitb" title="cgitb: Configurable traceback handler for CGI scripts."><code class="xref py py-mod docutils literal notranslate">cgitb</code></a> module.

If you haven’t done so already, just add the lines:

<div class="highlight-python3 notranslate"><div class="highlight"><pre>import cgitb

cgitb.enable()

</pre></div>

</div>

to the top of your script. Then try running it again; when a problem occurs,

you should see a detailed report that will likely make apparent the cause of the

crash.

If you suspect that there may be a problem in importing the <a class="reference internal" href="cgitb.html#module-cgitb" title="cgitb: Configurable traceback handler for CGI scripts."><code class="xref py py-mod docutils literal notranslate">cgitb</code></a> module,

you can use an even more robust approach (which only uses built-in modules):

<div class="highlight-python3 notranslate"><div class="highlight"><pre>import sys

sys.stderr = sys.stdout

print("Content-Type: text/plain")

print()

...your code here...

</pre></div>

</div>

This relies on the Python interpreter to print the traceback. The content type

of the output is set to plain text, which disables all HTML processing. If your

script works, the raw HTML will be displayed by your client. If it raises an

exception, most likely after the first two lines have been printed, a traceback

will be displayed. Because no HTML interpretation is going on, the traceback

will be readable.

</div>

<h2>22.2.9. Common problems and solutions<a class="headerlink" href="#common-problems-and-solutions" title="本標題的永久連結">¶</a></h2>

<li>Most HTTP servers buffer the output from CGI scripts until the script is

completed. This means that it is not possible to display a progress report on

the client’s display while the script is running.</li>

<li>Check the installation instructions above.</li>

<li>Check the HTTP server’s log files. (<code class="docutils literal notranslate">tail -f logfile</code> in a separate window

may be useful!)</li>

<li>Always check a script for syntax errors first, by doing something like

<code class="docutils literal notranslate">python script.py</code>.</li>

<li>If your script does not have any syntax errors, try adding <code class="docutils literal notranslate">import cgitb;

cgitb.enable()</code> to the top of the script.</li>

<li>When invoking external programs, make sure they can be found. Usually, this

means using absolute path names — <code class="xref std std-envvar docutils literal notranslate">PATH</code> is usually not set to a very

useful value in a CGI script.</li>

<li>When reading or writing external files, make sure they can be read or written

by the userid under which your CGI script will be running: this is typically the

userid under which the web server is running, or some explicitly specified

userid for a web server’s <code class="docutils literal notranslate">suexec</code> feature.</li>

<li>Don’t try to give a CGI script a set-uid mode. This doesn’t work on most

systems, and is a security liability as well.</li>

</ul>

註解

<tr><td class="label"><a class="fn-backref" href="#id2">[1]</a></td><td>Note that some recent versions of the HTML specification do state what

order the field values should be supplied in, but knowing whether a request

was received from a conforming browser, or even from a browser at all, is

tedious and error-prone.</td></tr>

</tbody>

</table>

</div>

<ul>

<li><a class="reference internal" href="#">22.2. <code class="docutils literal notranslate">cgi</code> — Common Gateway Interface support</a><ul>

<li><a class="reference internal" href="#using-the-cgi-module">22.2.2. Using the cgi module</a></li>

<li><a class="reference internal" href="#higher-level-interface">22.2.3. Higher Level Interface</a></li>

<li><a class="reference internal" href="#functions">22.2.4. Functions</a></li>

<li><a class="reference internal" href="#caring-about-security">22.2.5. Caring about security</a></li>

<li><a class="reference internal" href="#installing-your-cgi-script-on-a-unix-system">22.2.6. Installing your CGI script on a Unix system</a></li>

<li><a class="reference internal" href="#testing-your-cgi-script">22.2.7. Testing your CGI script</a></li>

<li><a class="reference internal" href="#debugging-cgi-scripts">22.2.8. Debugging CGI scripts</a></li>

<li><a class="reference internal" href="#common-problems-and-solutions">22.2.9. Common problems and solutions</a></li>

</ul>

</li>

</ul>

<a href="webbrowser.html"

title="上一章">22.1. <code class="docutils literal notranslate">webbrowser</code> — Convenient Web-browser controller</a>

<a href="cgitb.html"

title="下一章">22.3. <code class="docutils literal notranslate">cgitb</code> — Traceback manager for CGI scripts</a>

<li><a href="../bugs.html">Report a Bug</a></li>

<li>

<a href="https://github.com/python/cpython/blob/3.7/Doc/library/cgi.rst"

rel="nofollow">Show Source

</a>

</li>

</ul>

</div>

</div>

<ul>

<a href="../genindex.html" title="General Index"

>索引</a></li>

<a href="../py-modindex.html" title="Python 模組索引"

>模組</a> |</li>

<a href="cgitb.html" title="22.3. cgitb — Traceback manager for CGI scripts"

>下一頁</a> |</li>

<a href="webbrowser.html" title="22.1. webbrowser — Convenient Web-browser controller"

>上一頁</a> |</li>

<li><img src="../_static/py.png" alt=""

style="vertical-align: middle; margin-top: -1px"/></li>

<li><a href="https://www.python.org/">Python</a> »</li>

<li>

zh_TW

3.7.0

<a href="../index.html">Documentation </a> »

</li>

<li class="nav-item nav-item-1"><a href="index.html" >Python 標準函式庫 (Standard Library)</a> »</li>

<li class="nav-item nav-item-2"><a href="internet.html" >22. Internet Protocols and Support</a> »</li>

</form>

</div>

</li>

</ul>

</div>

The Python Software Foundation is a non-profit corporation.

<a href="https://www.python.org/psf/donations/">Please donate.</a>

Last updated on 8月 22, 2018.

<a href="../bugs.html">Found a bug</a>?

Created using <a href="http://sphinx.pocoo.org/">Sphinx</a> 1.7.7.

</div>

</body>

</html>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

FilesExpand file tree

cgi.html

Latest commit

History

cgi.html

File metadata and controls