From: Todd Gillespie <toddg@...>
Date: 2001-09-19T01:33:25+09:00
Subject: [ruby-talk:21343] Re: Suggestions for new CGI lib

On Wed, 19 Sep 2001, Niklas Frykholm wrote:
> On Wed, Sep 19, 2001 at 12:55:44AM +0900, Todd Gillespie wrote:
> 
> > > imho it should be possible to select the values in the shown way.
> > > just for security and to be more flexible.
> > > 
> > > ..:request.post["user_var"] or
> > > ..:request.get["user_var"]
> > > 
> > 
> > IMHO, this is dumb b/c a request can only be instantiated with either POST
> > or GET.
> > 
> > Correct way would be:
> > 
> > ..:request.form["user_var"]
> 
> While it is true that the request method in HTTP is either POST or
> GET, most servers (at least Apache) will send you both "post" and
> "get" variables, in a situation like this:
> 
>     <form action="test.cgi?get=data">
>         <input type=hidden name=post value=data>
>     </form>

Then that violates the spec.

> I think that the interface should support both post/get (for users who
> want to know where the data came from) and #[] for users who do not
> care. Implementation would probably be something like:
> 
>     def [](key)
>         post[key] + get[key]
>     end
> 

Or they can write their own layer that divides the form vars by checking
request.method, rather than make the API excessively topheavy.  Using
something like request.post[] as a method to 'know where the data came
from' makes the source less flexible than just checking request.method
when starting a CGI script or block.