Note: I'd appreciate some tag suggestions for this one..
I'd like to provide my users with a method of programmatically manipulating data on the server. This would be done by using an in-browser code editor to be executed at a later date, not dissimilar to the manner https://www.onx.ms employ.
I'd like to avoid writing a DSL (a barrier to adoption?), and would prefer the language that the user writes to be either JavaScript or Ruby based.
My obvious concern is security. I understand the perils of allowing user generated code to run server-side, but what steps can I take to eliminate the risk?
Do sites like http://railsforzombies.com actually use irb, or is it far simpler than that?
Would you consider Java (or other JVM languages such as JRuby, Scala, Clojure etc)? If so - there is a wealth of power in the JVM to restrict the privileges of a sandboxed app. See this other question for details: How do I create a Java sandbox?
Google Caja lets you safely embed user-specified Javascript in your website, but I think it might be aimed at running the code in the user's browser rather than on your server. I haven't used it myself.
I don't know if there are ready-made solutions for other languages, but I think a custom solution would involve recompiling the interpreter yourself after removing all API libraries that allow the user to write to disk, open network connections, fork processes/threads, and do any other dangerous or denial-of-service operation. Whitelisting "safe" libraries is the only approach that could work for that.
It would be safer if you had separate virtual servers for individual users.
looking into connecting to a secure ftp site (using perl), and downloading all the .log files, saving in new directories named after the day I downloaded the files. I want to do this without modules, as a learning experience, but before I start I wanted to know if you guys thought it was doing, or is way too much for a relatively new programmer and I should just learn the modules?
If it's production work, no, use the modules. Your implementation will be buggy, missing features and unknown to the next person maintaining that code.
Otherwise, yes. It's good to learn the principles of a network protocol. I do have a reservation about FTP as it is a bit baroque, insecure, inefficient and on its way out. scp, HTTP or rsync would be more useful to put your energy into.
I'd start with reading the RFC and putting together your own FTP module using just network sockets. Document and test it as if you were going to release to CPAN as a full learning exercise in making a network module. Run it against some various FTP server implementations as they often interpret the spec differently (or not at all). Don't be afraid to cheat and look at what the existing modules do. Who knows, you might write something better than what's already there.
Learning the principals, just like we did at school for long multiplication and division, means we know how things work when we use a short hand.
However, when new to the world,just like when you learn to speak, you did "A is for Apple" etc, you didnt get explained about the finesse of grammar and all that, you learnt to express yourself enough to be understood.
Programming is a little like the same. While in an ideal world you can easily argue a prewritten generic library is often way less efficient than a specifically targeted set of routines. If the wheel you are using was already invented, it seems a lot of work to make a new one.
So, use the wheels and cogs afailable, once you really have the hang of it, NOW look at inventing your own more efficient ones.
Ad cpan modules:
Modules are an great learning source. Here is zilion modules and you can really learn much studying some of them.
And when/while you mastering your perl, you will start writing you own modules. When your program will use modules anyway (yours one), you can ask - why don't use modules already developed and debugged?
So, learn perl basics, study some modules (for example Net::SFTP) and if you still want write your own solution - it is up to you. :)
'
I usually write web apps in PHP, Ruby or Perl. I am starting the study of Scheme and I want to try some web project with this language. But I can't find what is the best environment for this.
I am looking for the following features:
A simple way of get the request parameters (something like: get-get #key, get-post #key, get-cookie #key).
Mysql access.
HTML Form generators, processing, validators, etc.
Helpers for filter user input data (something like htmlentities, escape variables for put in queries, etc).
FLOSS.
And GNU/Linux friendly.
So, thanks in advance to all replies.
Racket has everything that you need. See the Racket web server tutorial and then the documentation. The web server has been around for a while, and it has a lot of features. Probably the only thing that is not included is a mysql interface, but that exists as a package on PLaneT (Racket package distribution tool).
UPDATE: Racket now comes with DB support, works with several DBs including mysql.
You may want to have a look at Clojure:
Clojure is a dynamic programming language that targets the Java Virtual Machine. [...] Clojure provides easy access to the Java frameworks, with optional type hints and type inference, to ensure that calls to Java can avoid reflection.
Clojure is a dialect of Lisp, and shares with Lisp the code-as-data philosophy and a powerful macro system.
Interop with Java is straightforward in Clojure, so you can re-use any existing Java libraries as you need. I'm sure there are plenty that are useful for web development.
clojure-contrib has an SQL API, and there is ClojureQL as well, which should cover your DB access needs.
There is a web framework for Clojure called Compojure under development. There may be others, too.
Clojure's source is available on github under the EPL. Getting it running on Linux is easy; I just clone the git repos and run ant.
You can do web development with guile scheme. Its standard library includes the (sxml simple) module that is very useful for html generation, manipulation, and parsing. The guile-www library adds support for http, cgi, etc. The guile-dbi library provides access to MySQL and other databases. With these building blocks, you can implement everything from simple cgi scripts to web applications with their own HTTP server.
Try Weblocks, a Common Lisp web framework:
http://weblocks.viridian-project.de/
I've written a pretty extensive tutorial/ebook on the topic: http://lispwebtales.ppenev.com/
Quick summary:
It uses Common Lisp
It uses the Restas framework
It has examples for pretty much most of basic web development, including DB access, authentication, HTML generation and templating.
Since the Restas documentation is pretty much out of date, my tutorial is the closest thing to up to date docs.
Shows a few of the more advanced features, like policies, which allow you to write pluggable interfaces, for instance you can write a data store layer, and write back-ends for different storage mechanisms with relative ease, the module system which allows you to write reusable components, like auth frameworks and things like that.
It covers things like installing lisp, setting up the ASDF build system and the quicklisp package manager etc.
It's free online, and as soon as I finish it it will be free on leanpub as well. The source is on https://github.com/pvlpenev/lispwebtales under a CC license, the source code is MIT. Not all of it is published yet, and I'm in the process of revising.
This may be what you are looking for.
http://www.plt-scheme.org/
http://docs.plt-scheme.org/web-server/index.html
http://common-lisp.net/project/cl-weblocks/
If you are interested in Common Lisp to be exact and do not want to go the weblocks route I would recommend the following setup:
Use SBCL on Linux but with multiple thread support
Use Hunchentoot as a web server which will provide you with all the server processing required including sessions and cookies
Use ClSql to communicate with MySql it has ample documentation and is very stable.
For the HTMl generation you can use Dr Edi Weitz Cl-WHO (very well documented).
Note all the above are under GPL or similar license (one that works more for lisp programs)
Gambit Scheme has its own solution to web apps as well. It uses the Spork framework, based o the Black Hole module system (both by Per Eckerdal).
Andrew Whaley has an initial tutorial on how to get Gambit, Black Hole and Spork running a web app under Apache using mod_proxy. You might want to take a look at that.
On a (possibly) related note, Gambit will also compile your stuff to C and then to an executable, if you feel so inclined.
Paul Graham (and friends) made a lisp dialect specifically for writing basic web applications. It's called Arc, and you can get it at arclanguage.org.
It's probably not suited for really big complex websites and I'm not sure what state it's database support is at but Paul Graham knows how to write web applications in lisp, so Arc will make the HTTP/HTML part easy for you while you spend most of your brain cycles learning the lisp way.
Weblocks is nice tool for building web apps in Common Lisp, but a bit too heavy-weight for me.
We use the following stack:
OpenMCL (open source Lisp, very nice)
Portable Allegroserve (web server, HTML generator)
Our own Rails-like tools for doing Ajaxy stuff (update: this has now been open sourced as WuWei)
A variety of CL libraries like cl-json, cl-smtp, md5
I use my own, customized version of Scheme, derived from MzScheme. It has a new, simple web-application framework, a built-in web-server (not the one that comes with MzScheme) and ODBC libraries. (http://spark-scheme.wikispot.org/Web_applications). The documentation may not be exhaustive, as this is more of a personal tool. But there are lots of sample code in the code repository.
Clojure is a Lisp dialect which may interest you. At this point there's a pretty decent web development stack. I can recommend a few things:
The leiningen dependency manager which makes is really easy to install and manage libraries that you're using. Pretty nice set of plugins for it too. There's even a plugin for Clojurescript, which is a language based on Clojure that compiles to Javascript.
The ring HTTP server abstraction. Its used in most actual web frameworks. Its a pretty good idea to learn that first before jumping into an actual framework.
hiccup is a HTML dsl/templating language written in Clojure. Its very expressive! Reminds me a bit of Jade, in a sense.
composure would have to be the most popular web framework for Clojure. Its essentially a routing library like express.js.
Let's see what can be done with Common Lisp.
The state of the Common Lisp ecosystem (2015) and the Awesome Common Lisp list show us a couple of modern frameworks (Caveman, Lucerne, all built on the new Clack web application server, an interface for Hunchentoot and other servers). Let's discuss with our own findings.
update 2019: there's a new tutorial on the Common Lisp Cookbook: https://lispcookbook.github.io/cl-cookbook/web.html It covers routing, template engines, building self-contained binaries, deployment, etc.
update: a bit later, I found out Snooze, by the creator of Sly or Emacs' Yasnippet, and had a much better impression than say Caveman. Declaring endpoints is just like declaring functions, so some things that were tedious in Caveman are obvious in Snooze, like accessing the url parameters. I don't have much experience with it but I recommend checking it out.
update june 2018: also don't miss the ongoing rewrite of Weblocks, it's going to be huge ! :D http://40ants.com/weblocks/quickstart.html Weblocks allows to build dynamic webapps, without a line of Javascript, without separating the back and front. It is components-based, like React but server-side. It's very alpha as of writing (june 2018), but in progress, and it's working, I have a couple simple web apps working.
A simple way of get the request parameters (something like: get-get #key, get-post #key, get-cookie #key).
I found easier the Lucerne way, it iss as simple as a with-params macro (real world example):
#route app (:post "/tweet")
(defview tweet ()
(if (lucerne-auth:logged-in-p)
(let ((user (current-user)))
(with-params (tweet)
(utweet.models:tweet user tweet))
(redirect "/"))
(render-template (+index+)
:error "You are not logged in.")))
Caveman's way has been less clear to me.
Mysql access
Caveman advertises database integration (with Fukamachi's Datafly and sxql).
You can just use clsql or the Mito ORM: https://lispcookbook.github.io/cl-cookbook/databases.html
HTML Form generators, processing, validators, etc.
I don't know if there are form generators out there. edit: there are: cl-forms and formlets, or again 1forms, working with Caveman2.
Caveman does not have one (issue raised in 2011).
Helpers for filter user input data (something like htmlentities, escape variables for put in queries, etc).
Ratify is an input validation library, not integrated into a framework though.
FLOSS and GNU/Linux friendly: ✓
Other web stuff
Speaking about web, there are other nice libraries in CL land:
web servers: Woo is a fast HTTP server, faster than Nodejs (beware of charts…), wookie is an async http server,
Dexador is an HTTP client
Plump, lquery and CLSS make it easy to parse html and query the DOM.
cl-bootstrap offers twitter-bootstrap shortcuts for the cl-who templating engine (which kind of replaces Jade/Pug, even though we have usual templates too).
Ajax in Lisp
(remember, with Weblocks, see above, we might not need those)
With ParenScript, we can write JavaScript in Common Lisp, without living our usual workflow, and we can thus use the fetch web API to write Ajax calls.
Clojure would be perfect for this. With some very short, clean code, you can implement some very complex applications, such as blogs or forums.
You might want to consider the awful web framework for Chicken Scheme.
Natively supports PostgreSQL and SQLite
Built-in easy support for sessions
Shortcuts for some webdev idioms, like the (ajax) procedure
Your app can be easily compiled to a static executable (via csc -static) for easier deployment
The collection of all chicken libraries (eggs) isn't as versatile as in some other programming languages, but isn't awful either
So, there are several languages which will allow you to create a website, as long as you configure the server(s) well enough.
To my knowledge, there is:
PHP
ASP.NET
Ruby(on rails, what is
that all about?)
And thusly, my knowledge is limited. Ruby and ASP, I've only heard of, never worked with. If there are other languages, I suppose they have some way to make files containing the needed html. It would then suffice to add a line to the Apache config to associate the file-extension.
And if other languages: are there any notable characteristics about the one(s) you mention?
ANY language can be use to make a dynamic website - you could do it in COBOL or FORTRAN if you were twisted enough. Back in the olden days (about 10 years ago) most dynamic websites were done with CGI scripts - all you needed was a program that could read data from standard input and write data (usually HTML) to standard output.
Most modern languages have libraries and frameworks to make it easier. As well as the languages you have already mentioned, Java, C# and Python are probably the most common in use today.
Typically a web framework will have:
a way of mapping URLs to a class or function to handle the request
a mechanism for extracting data from a request and converting it into an easy to use form
a template system to easily create HTML by filling in the blanks
an easy way to access a database, such as an ORM
mechanisms to handle caching, redirections, errors etc
You can find a comparison of popular web frameworks on wikipedia.
How can you forget Java ? :)
Python
It runs on Windows, Linux/Unix, Mac OS X, and has been ported to the Java and .NET virtual machines.
Python is a perfect scripting language for web applications, e.g. via mod_python for the Apache web server. With Web Server Gateway Interface a standard API has been developed to facilitate these applications. Web application frameworks or application servers like Django, Pylons, TurboGears, web2py and Zope support developers in the design and maintenance of complex applications. Around libraries like NumPy, Scipy and Matplotlib, Python is a standard in scientific computing.
Among the users of Python are YouTube and the original BitTorrent client. Large organizations that make use of Python include Google, Yahoo!, CERN, NASA,and ITA.
This could be for your interest.
Virtually thru CGI all programming languages that produce output may use for web page generation.
Basically, you can use any language (if you are hosting your own server)
Very closely related and very interesting is this article where LISP has been used to build a very succesfull website.
Python has a 3rd party module CherryPy which can be used with or without a http server.
Amongst others: Erlang (YAWS, Mochiweb), Python
JSP has the advantage that it automatically wraps your code in a servlet, compiles that to bytecodes, then uses the just-in-time Java compiler to recompile critical sections into native object code. Not aware of any alternative which allows optimizes your work automatically in this way.
Also allows you to develop and deploy on any combination of Windows, Mac OS X, or Linux.
If you'd like to choose one for the beginning, you should check out PHP first. It gives you the basic clues about how dynamic sites work in general.
After you've become familiar with the basics, I recommend ASP.NET.
Fist off, you should know that ASP.NET is a technology and not a language. (It actually supports any language that can be used on the .NET platform.) Also it is not to be confused with classic ASP. (The old ASP was much more like PHP.)
ASP.NET is very easy to begin with, and after you have some clues about its concepts, you can always dig deeper and customize everything in it. The http://asp.net site is a very good starting point, if you are to learn it. I think it is really worth the effort, because even if you choose not to stick to it, it will give you some interesting ideas and concepts.
I tell you its most important advantages:
The code is compiled (and NOT interpreted like PHP), and it has a very good performance. (In a performace comparsion, it is 10-15 times faster. http://www.misfitgeek.com/pages/Perf_Stat_0809.htm)
It can be run on Windows without effort, and on Linux / Mac / etc using the Mono project.
It implements the Separation of Concerns principle very well.
It has most of the general functionality you'll need built-in. (Such as membership, roles, database management, and so on.)
I'm looking at introducing multi-lingual support to a mature CGI application written in Perl. I had originally considered rolling my own solution using a Perl hash (stored on disk) for translation files but then I came across a CPAN module which appears to do just what I want (i18n).
Does anyone have any experience with internationalization (specifically the i18n CPAN module) in Perl? Is the i18n module the preferred method for multi-lingual support or should I reconsider a custom solution?
Thanks
There is a Perl Journal article on software localisation. It will provide you with a good idea of what you can expect when adding multi-lingual support. It's beautifully written and humourous.
Specifically, the article is written by the folks who wrote and maintain Locale::Maketext, so I would recommend that module simply based upon the amount of pain it is clear the authors have had to endure to make it work correctly.
If you have the time then do take a look at the way the I18N is done in the Jifty framework - although initially quite confusing it is very elegant and usable.
They overload _ so that you can use _("text to translate") anywhere in the code. These strings are then translated using Locale::Maketext as normal.
What makes it really powerful is that they defer the translation until the string is needed using Scalar::Defer so that you can start adding the strings at any time, even before you know which language they will be translated into. For example in config files etc. This really make I18N easy to work with.