From: Kent Dahl <kentda+news@...>
Date: 2004-06-11T19:28:43+09:00
Subject: Re: cgi maintaining state information

Cere Davis wrote:
> 
> I wonder if the following behaviour of cgi.rb is deliberate?
> 
> If I have a cgi radio_button element like:
> 
> cgi.radio_button("radioname")

Check the documentation at:
   http://www.ruby-doc.org/stdlib/
for the API of the CGI module.

Direct link:
http://www.ruby-doc.org/stdlib/libdoc/cgi/rdoc/classes/CGI/HtmlExtension.html#M000044

> where the radio button is unchecked, then I post into the cgi form a 
> name value pair for radioname like:
> 
> radioname=something
> 
> and get:
> 
> <INPUT TYPE="radio NAME="radioname">
> 
> for output...
> 
> it seems to me that the cgi.rb should print out the value attribute of 
> "somthing" in the html output instead of just printing the prior state 
> of the form.

You are asking the CGI module to automatically retain the selected value 
attribute passed as a parameter into the new form? Why should it? It may 
be a completely different form, where the name has other semantics.

The CGI API requires the selected value to be explicitly given, which is 
the correct and safe way to do it. (Your suggestion reminded me of PHP 
and the automatically mapping to globals variables it used to have.)


> Why wont cgi.rb capture the state of values posted into it?

Yes it does, as you may retrieve them from the CGI instance. But it does 
not assume that the form you generate using it is the same form your 
input values came from. That is plain dangerous regarding cross-site 
scripting and other nefarious activities people abusing your system 
would just love.

However, there is nothing stopping you from writing your own 
modifications to the cgi module doing what you want. (I.e. all default 
values are taken from the input parameters if nil.) But please 
understand that this means that _default_ values in your form may be 
from external sources and thus dangerous!

-- 
(\[ Kent Dahl ]/)_    _~_    _____[ http://www.pvv.org/~kentda/ ]_____/~
  ))\_student_/((  \__d L b__/     Master of Science in Technology     )
( \__\_�|�_/__/ ) _)  Industrial economics and technology management (
  \____/_�_\____/ (____engineering.discipline_=_Computer::Technology___)