how to handle two forms in cgi?

[lli]

Hi Guys,

I am a new cgi programmer. Now I need to design a web application:
1. first, user login by their username and password in a form (login
form). When users click submit button it connect to database and check
user name and password in a table. If it match in a table, form1.py
should show second form for users in their browser. I have finish this
form. It works well.
2. second form (search form) which contain last name, and first name
which users input data. When user click submit button, it connect
database and search in a table. And the search result need to show in a
list or table in users' browser.

My question is: How let these two form works together? I try to use
two codes for these two forms, e.g. Login.py for login form and
search.py for search form. But when user input data in search form and
click its submit button, it just comes back to login form. Second form
doesn't work.

Any help is appriciated!

Thanks,

LLI

[Dan M]

> My question is: How let these two form works together? I try to use

two codes for these two forms, e.g. Login.py for login form and
search.py for search form. But when user input data in search form and
click its submit button, it just comes back to login form. Second form
doesn't work.

Any help is appriciated!

It sounds like the "action" attribute in the 2nd form's <form> tag is not
pointing to search.py.

[lli]

Hi Dan,

Sure. You are right. When I correct this according to your idea, it
works now. Thank you very much. But I have second problem. When users
run second form, other people can see adress in users' browers and know
how to run the second form, so they don't need to run login form. How I
can handle this case? How I can let users run login form firstly, then
they can run second form(search form)?

By the way I use python to write cgi.

Any help is appriciated!

[Steve Holden]

ll*@sos.state.tx.us wrote:

Hi Dan,

Sure. You are right. When I correct this according to your idea, it
works now. Thank you very much. But I have second problem. When users
run second form, other people can see adress in users' browers and know
how to run the second form, so they don't need to run login form. How I
can handle this case? How I can let users run login form firstly, then
they can run second form(search form)?

By the way I use python to write cgi.

Any help is appriciated!

I'm afraid you are running into what are called "session state"
problems. In other words, your system needs to be able to "remember"
that a user has already successfully visited one page before allowing
them to visit another.

There are various ways to solve this problem, but most of them revolve
around maintaining state information for each different concurrent user
of your web. Once a user successfully logs in your record "logged in =
True" or similar in your session state memory, and at the start of each
CGI script for which the user is required to be logged in you actually
check the state memory to verify that is the case.

There are various mechanisms for maintaining session state, many of
which rely on serving a cookie to each user's browser. This allows your
server to identify which session any particular request is a part of.

See if

http://starship.python.net/crew/dave...i?req=all#2.11

makes any sense to you. If not, you might want to Google around a bit
for things like "Python web session" to see what you can find.

Note there are plenty of web frameworks (e.g. CherryPy, mod_python) that
offer assistance with maintaining session state, but it isn't impossible
to maintain it yourself in CGI scripts once you understand the problem.
Good luck!

regards
Steve
--
Steve Holden [phone] [phone]
Holden Web LLC www.holdenweb.com
PyCon TX 2006 www.python.org/pycon/

[lli]

Hi Steve,

Thank you for your information. Your idea is helpful for me.
By the way, could I use "hiden" to handle this case?

Laya

[Fuzzyman]

ll*@sos.state.tx.us wrote:

Hi Dan,

Sure. You are right. When I correct this according to your idea, it
works now. Thank you very much. But I have second problem. When users
run second form, other people can see adress in users' browers and know
how to run the second form, so they don't need to run login form. How I
can handle this case? How I can let users run login form firstly, then
they can run second form(search form)?

By the way I use python to write cgi.

You can use logintools to add a user authentication framework to any
CGI with very little work.

This lets you control who is able to login (whether or not new users
can sign up and you have an interface to create/invite new users).

It will also prevent any script being run unless the user is logged in.
It uses cookeis for authentication and can be added to a standard CGI
with as little as two lines of code.

It is designed for exactly the problem you have.

http://www.voidspace.org.uk/python/logintools.html

All the best,

Fuzzyman
http://www.voidspace.org.uk/python/index.shtml Any help is appriciated!

[Steve Holden]

ll*@sos.state.tx.us wrote:

Hi Steve,

Thank you for your information. Your idea is helpful for me.
By the way, could I use "hiden" to handle this case?

Laya

Yes, some systems have done that, some have used a component of the URL
path, but you have to remember that the hidden items are available to
anyone using "view source" in their browser (or writing a client program
to do the equivalent thing), so your mechanism will be quite obvious to
hackers.

regards
Steve
--
Steve Holden [phone] [phone]
Holden Web LLC www.holdenweb.com
PyCon TX 2006 www.python.org/pycon/

[lli]

Steve,
You are right. I just test it. If users login application sucessfully,
then they can see hidden values by view source. Next time they can use
URL path ? key = value to open the second form. I will use session to
handle it.

By the way, do you write a book "Python Web Programming"? It is on my
desk. It's a great book.

Thanks,
Laya

[lli]

Thank you, fuzzyman.
LLi

[Steve Holden]

ll*@sos.state.tx.us wrote:

Steve,
You are right. I just test it. If users login application sucessfully,
then they can see hidden values by view source. Next time they can use
URL path ? key = value to open the second form. I will use session to
handle it.

By the way, do you write a book "Python Web Programming"? It is on my
desk. It's a great book.

That was me. Glad you like it!

regards
Steve
--
Steve Holden [phone] [phone]
Holden Web LLC www.holdenweb.com
PyCon TX 2006 www.python.org/pycon/