in reply to Hide parameters - CGI

There's only a few ways to pass parameters from a web browser to the CGI on the other end of the web server. With a 'GET' request, all the parameters will be displayed in the address bar. If you want to avoid the user seeing those parameters, then you need to use another method.

If you're stuck on using 'href' links, one way to do it might be to use Javascript:
<script type='text/javascript'> function submitForm ( formName ) { document.getElementById( formName ).submit(); return true; } </script> <form action="http://127.0.0.1/cgi-bin/test.cgi" method='POST' id='tes +tForm'> <input type=hidden name='name' value='tom'> <input type=hidden name='value' value='12'> <input type=hidden name='id' value='52345'> <input type=submit value='Test Link as Button'> <a href="http://127.0.0.1/cgi-bin/test.cgi" onClick = "submitForm('testForm');" onMouseOver = "window.status = 'http://127.0.0.1/cgi-bin/test.cgi'; r +eturn true;" onMouseOut = "window.status = ''; return true;" >Test Link</a> </form>
In that example, you use JavaScript to do the form submitting for you. It still is a POST, but you can use a 'href' type link to activate it. The onMouseOver and onMouseOut try to hide the fact that clicking the link calls javascript and it's not a normal link. You don't need to put anything in the destination URL, it could be just 'href=""', but the javascript won't kick in if the user right-clicks the link (to open in new window or new tab).

Another way might be cosmetically better, you can pass parameters as if they were folders:
<A HREF="http://127.0.0.1/cgi-bin/test.cgi/tom/12/52345">Test Link</A>
This is the way Amazon.com works. You can access the extra path variables by looking at
my $extra_path_info = $ENV{'PATH_INFO'}; # or use CGI; my $query = new CGI(); my $extra_path_info = $query->path_info(); print $extra_path_info; # prints '/tom/12/52345'
Yet another way might be to pass the parameters as cookies.
<script type='text/javascript'> function submit_cookies ( formId ) { var thisForm = document.getElementById( formId ); if( ! thisForm ) return true; var formLocation = thisForm.action; // Run through all the form variables and convert // them all to cookies for( var i = 0; i < thisForm.elements.length; i++ ) { var elementName = thisForm.elements[i].name; var elementValue = thisForm.elements[i].value; document.cookie = elementName + '=' + elementValue + ';'; } window.location = formLocation; return true; } </script> <form action="https://vmacs.vmth.ucdavis.edu/echo" method=POST id='tes +tForm'> <input type=hidden name='name' value='tom'> <input type=hidden name='value' value='12'> <input type=hidden name='id' value='52345'> <a href="#" onClick="submit_cookies('testForm');">Test Link</a> </form>
This particular solution has some drawbacks too. You can't usually set cookies for another domain, so the page that generates the cookies must come from the domain that the form posts to. You'll note that even though the form is all there (and it's set to 'POST'), no POST is done. The javascript function just fetches the 'action' parameter out of the form to use to submit the form. Then it runs through all the form variables to send them as cookies. There's lots of drawbacks using cookies too.

Some other solutions: None of these solutions use Perl though. Perl is powerful, but it still has to work within the limitations set by the HTTP protocol. You might want to check some javascript or web developer forums and ask your question there. Perl mostly deals with web requests after it's already been sent to the web server and processed. To modify browser behaviour, you need another language (until those mozilla folks add support for Perl scripts that run in the browser!).

Replies are listed 'Best First'.
Re^2: Hide parameters - CGI
by Anonymous Monk on Nov 24, 2010 at 14:11 UTC
    Thank you very much for your posting these examples. It really helped me.