Mailing-List: contact modules-dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: modules-dev@httpd.apache.org
Received-SPF: neutral (nike.apache.org: local policy)
Mime-Version: 1.0 (Apple Message framework v753.1)
In-Reply-To: <290073.91554.qm@web31803.mail.mud.yahoo.com>
References: <892935.30955.qm@web31807.mail.mud.yahoo.com>
 <290073.91554.qm@web31803.mail.mud.yahoo.com>
Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed
Message-Id: <FB3B8EB2-7EA4-405E-88CC-71E218B81684@apache.org>
Content-Transfer-Encoding: 7bit
From: Nick Kew <niq@apache.org>
Subject: Re: Input filter to process POST variables (e.g. mod_form)
Date: Wed, 25 Mar 2009 20:10:39 +0000
To: modules-dev@httpd.apache.org


On 25 Mar 2009, at 14:34, Erik Westland wrote

>
>> From: Erik Westland <erikwestland@yahoo.com>
>> To: modules-dev@httpd.apache.org
>> Sent: Saturday, March 21, 2009 11:22:52 PM
>> Subject: Input filter to process POST variables (e.g. mod_form)


I'm sure I recollect replying to that question a few days ago:
in fact my mailer shows your question as replied to.  Guess
maybe it got lost in the ether.

>> It seems that "mod_form" (see: http://apache.webthing.com/ 
>> mod_form/) does the
>> parameter processing, but comes with the following ominous caveat:
>> "mod_form works with GET but is largely untested under POST, and  
>> appears to have
>> problems with POST and HTTP Keepalive. That will be fixed, but  
>> it's not
>> currently a priority."

There was some test case where it hung.  I've also had reports of it  
working
successfully with POST.

>> Q: Does anyone know if this is safe to use? Their support page  
>> lists mod_form
>> as: "unlikely to represent value to you."

That means I don't want anyone making the voluntary donation my pages  
invite
on the false premise that it's a tried-and tested production-grade  
module.

>> Q: Is there another alternative to writing my own? If not, any  
>> idea what the
>> keepalive issue was?

mod_request (didn't exist when I wrote mod_form).  Or apreq (did exist,
but a more heavyweight solution).

>> Q:  Apache processes variables in the URL (parses into r->args)  
>> during POST
>> requests, but the mod_form implementation doesn't look for r->args  
>> when handling
>> POST requests. Is this disallowed/discouraged in the spec or an  
>> oversight in the
>> implementation?

Both.  It's an edge case, and a mod_form incompleteness.  But it  
won't bite you
unless your application uses a POST form with a query_string in the  
action.
Or perhaps does similar for non-browser data.

-- 
Nick Kew