Introduction to the Common Gateway Interface (CGI)

The Common Gateway Interface runs an external program (a 'CGI script') as a result of a client request and returns the output of the program to the client.

CGI defines the interface between the web server and the CGI script. The CGI script is short-lived - it only runs for the duration of the request. The author is free to program the script in almost any language. CGI is extremely powerful because there are very few limits on what the CGI script can be programmed to do.

Languages used for writing CGI scripts

CGI scripts are commonly written in C or Perl. Perl is a very rich scripting language, with great support for common CGI operations like string manipulation, and CGI scripts can be created very quickly using this language. However, Perl scripts are relatively expensive to run (in terms of resources required - CPU cycles, memory foot print, startup time), so for performance-critical CGI scripts, C is commonly used. Libraries are freely available for both languages that help in processing the request data from the web server.

CGI scripts are rarely written in a shell scripting language because of well-founded security concerns. The author of the script must always be aware of the security implications of running a program on the web server, and shell script interpreters have too many additional features that could be exploited by a malicious attacker.

Strengths and weaknesses of CGI

CGI is flexible, easy to develop and easy to deploy, but carries a significant penalty that impacts the performance and scalability of heavily loaded web sites. On every CGI request,the web server must fork(); the child must release all resources it inherited from the web server parent (file descriptors, mem-mapped regions etc.); then the child must exec() the CGI binary.

CGI is very appropriate for lightly-loaded or over-specified web server installations and for prototyping web applications in a development environment, but is not suitable for a web site installation that needs to scale or operate at or near the limits of the server hardware.

Advantages

• Simple to write
• Portable across many server platforms
• Can be written in many languages e.g. Perl, C, etc.(input from environment variables, output to standard output).

Disadvantages

• Performance limited - server must fork new process for every request
• Provides no mechanism to maintain state across requests (e.g. while browsing on-line store)
• Must implement it yourself.

Content Manager [Administrator] 16 December 2005