EZSurvey CGI 6

Additional resources

• EZSurvey CGI programmer's wall chart
• EZSurvey Scripting Guide
• Reporting language
• Open DataBase Connectivity
• INI files
• Project .VAL file
• Error reference
• cgi.h

Important classes and functions

• CGImain()
• CGINameValue
• HTMLWrite()
• HTMLPrintf()
• SetLoggingLevel()
• RunScript()
• RunReport()
• CGINameValue
• TextBuffer
• EZSSTREAM
• SQLDB
• ScriptEnvironment

Version history

• 6.4.2
  • Fixed a bug in save/resume
  • Page names don't have to start with "page". _PAGEBACK is automatically stripped. Sorry, not backward compatible.
  • Switched from BCC to GCC for Windows
• 6.4.1
  • Moved some linefeeds around in SendMail for Unix.
  • Unix tries SMTP before sendmail
  • SMTP sets From: and To: headers
  • Fixed a null-pointer-read in cgi_js.c
  • Fixed a null pointer on invalid function call traps in cgi_js.c
• 6.4
  • Automatically convert ANSI to UTF-8
  • Int16toUTF8 uses unsigned int instead of signed int
  • Fixed ReadPairedString("Raosoft,Survey") for save/resume to load the password list.
• To do
  • <report odbc://user:pass/ select * from table where ifmuid=$ifmuid %> ... </report>
• 6.3
  • DatabaseSaveNewRecord() does an atomic write, using a memory buffer
• 6.2
  • HTMLEscape() converts UTF-8 to escaped HTML. HTMLWrite() bypasses the conversion!
  • When printing replacements, field values are escaped, but literals are not.
  • JS escape() function converts UTF-8 to escaped HTML, too.
• 6.1
  • Improved XSS attack detection
  • Report attacks in logerr.txt instead of logmsg.txt.
• 6.0
  • Added B64encode()
  • ReadHTMLTags -> ReadHTMLAttributes, WriteHTMLTags -> WriteHTMLAttributes
  • ReadINIFileSection uses fopen() instead of GetPrivateProfileSection() on Windows -- less code.
  • Response counter uses .respcount file on all platforms -- allows us to determine the "last submission" date.
  • New admin.cgi to handle complex administration tasks. Replaces dbadmin.cgi for enterprise installations (which use SQL as well as ASCII).
  • Inline replacements don't require $'s on field names. $'s now mean to fetch from a secondary data vector. EvaluateExpression() will disregard legacy $'s if no data vector is available, as with variable piping as published by EZSurvey 2004. EZSurvey 2004 will not insert $'s in variable piping, expecting you to use a " or ' instead.
  • Overhaul scripting language. Better expression evaluation. Better error reporting. Better testing procedure. Add substr, length, indexOf functions.
  • Dropped LoadDatabaseHeader()
  • Smarter IsNumber() function
  • EvaluateExpression() (string) replaced with EvaluateAlgebra() (number).
• 5.10
  • Removed redundant access() calls for portability
  • More information for error codes from cgi_data.c
  • More error information printed by ezs.c
  • Replace flock() with fcntl() in SaveDataToXML()
• 5.09
  • ODBCConnect calls SQLDriverConnect if the service contains an = sign
• 5.08
  • Fixed
    filtering in data reception.
• 5.07
  • Improved INT16toUTF8()
  • Fixed submission validation for single-page forms
• 5.06
  • Logical evaluation can iterate over all fields, not just primary ones
  • Fixed C++ and C style comment parsing in scripting
  • Allow literals in comparisons: if ("1,2,3" has "3")
  • Corrected a loop variable error in GetField()
  • Updated SQL escape(text,extra_chars) function
  • All override error handling for ODBCConnect() (default on, formerly off)
• 5.05
  • Don't run UPDATEODBC if IDFIELDS are blank
  • Return a fatal error if OpenODBC or DatabaseOpen fails on login
• 5.04
  • Moved some of the commonly used JS* functions to cgi_js.c
• 5.03
  • Add XP_POSIX, Replace flock() with fcntl file locking.
  • Use Windows file functions in DatabaseSaveNewRecord on Windows
  • Drop file creation from SaveDataToASC (Use DatabaseSaveNewRecord instead)
  • RunReport() skips { blocks} if { is followed by whitepsace. Allows CSS.
• 5.02
  • POST data is limited to 65535 bytes per field. The entire transaction will be ignored if the POST transmission is too large. Doesn't apply to ISAPI, because the server enforces its own length constraints.
• 5.01
  • IE 5.2 on Mac sent a nonstandard CONTENT_TYPE MIME header. Now only checking the first 33 bytes of CONTENT_TYPE on POST transactions.
• 5.00
  • Fixed null bug in SetValue()
  • Main programs renamed to ezs.c, plot.c, list.c, dbadmin.c, wf.c, and updated makeall.* scripts accordingly
  • Added interactive UI for plot.c
  • EvaluateLogic() can handle nested parenthesis. Conditional evaluation makes queries go faster, too.
  • ezs.c::SaveData(). SAVEDATA and SAVEXML default to 0. Also fiddled with the Location: HTTP header.
  • Add ACTIVE, IDFIELDS, LOGIN settings for cgi_ezs.c. Lets you disable a database, specify alternate id/password fields, login and save/resume with and ODBC database as well as ASCII, while still saving data to either or both.
  • SAVEODBC tries to update before saving. The UPDATEODBC script should look like [UPDATE table SET "field1"='{value1}', "field2"='{value2}' WHERE "IFMUID"='{IFMUID}'] or [UPDATE table SET "field1"='{value1}', "field2"='{value2}' WHERE "_SESSION"='{_SESSION}']. If this fails, or the UPDATEODBC script is not found, fall back to the SAVEODBC script, [INSERT INTO TABLE (fields) VALUES ({values}) ]
  • READODBC script translates from ODBC fields into HTML fields
  • Add LOADODBC, UPDATEODBC scripts
  • Improved ReadPairedString()
  • Added B64decode, UTF7toUTF8, qpdecode for handling unusual transmission encodings
  • Moved EvaluateLogic() and friends to cgi_util.c
  • Dropped warning messages from DoesFileMatchForm in cgi_data.c
  • Update EvaluateComparison to not modify the Comparison string.
• 4.80
  • Add SetValue(), SetName() functions
  • Add ODBCQuery, ODBCSelect, ODBCRead, ODBCFinish
  • Changed __WIN32__ references to XP_WIN
  • Added WIN64 detection
• 4.70
  • Add ISAPI output buffering
• 4.69
  • cgi_ezs.c gets a uniqueID script function
  • LOGLEVEL defaults to zero (catastrophic error only)
  • Added LogMessage to differentiate from LogError
  • Added error handling to RunScript()
  • Optimizations for Pocket PC
  • Included Pocket PC and Personal Server C++ code
  • Add ACCEPT-CHARSET=UTF-8 Form attribute
• 4.68
  • Added the download data file login screen to cgi_admin.c
  • Fixed null-value bug in cgi_search.c
  • Remember to check for null value whenever a CGINameValue is used directly. GetSetting does this implicitly. Why not use empty strings instead of nulls? To save the time for all the memory allocations that would be necessary.
  • Initialize unspecified fields to "" in cgi_data.c
• 4.67
  • Replaced FOPEN,FCLOSE,MALLOC FREE with CGIFOPEN, CGIFCLOSE, CGIMALLOC, CGIFREE macros.
• 4.66
  • Fixed bug in cgi_util.c javascript "if else" statements
• 4.65
  • Replaced FOPEN, FCLOSE, MALLOC, FREE with macros to reduce risk of memory errors
• 4.64
  • Custom error page 'error.html'.
  • Fix bug in 'has' operator
• 4.63
  • Add ReadUntilWord2()
  • JS: data['fieldname'] or data[variable_name] to retrieve data values.
  • Edit report handling of if elsif/elif else end/endif
  • A bare <end> command ends the report immediately, but not if it finishes an if section
  • Add JS delete operator
  • Add 'previous' validation script to un-do changes when Previous is set. You can block the 'previous' action by setting _PAGEWARN=1.
  • Simplified scripting
    • <ezs include filename %> is now <include filename %>
    • <ezs report filename query %> is now <report filename query %>
    • <ezs source filename %> is now <source filename %>
    • <ezs stats filename %> is now <stats filename %>
    • <ezs random key1 key2 %> is now <irandom key1 key2 %>
  • New JS function random(max) gives a pseudo-random integer between 0 and max.
• 4.62
  • Remove all getenv() references from cgi_util.c. Expressions containing $ENVIRONMENT_VARIABLE terms are no longer available to improve web security. (Nobody ever used this feature anyway)
• 4.61
  • JS can add unlimited variables.
  • CGINameValue has a new 'last' entry used to flag the last element of a CGINameValue list created by NewNVP.
• 4.6
  • Compiles under Embedded Visual Tools for Windows CE
    • Very Personal Web Server for Windows CE
    • Multithreaded PocketPC server
    • Summary calculations not available on CE
    • Max number of responses not available on CE
    • $Environment variables do not exist
    • Caches SMTP email and sends when connected
    • ReadINIFileSection uses FILE instead of WIN32 functions
      • Delayed-action SOAP (need to finish XYKE Database Server!)
  • LoadSettings function deleted
  • A random seed is stored in a "random.ezs" (UNIX) file or in the registry (Windows) to reduce duplicate session IDs on UNIX
  • File paths from the .ini file may be fully-qualified. They should start with '/' (unix), '\' (CE), '\' or 'c:' (Windows)
  • DeleteOldRecords function in cgi_ezs.c marks previous records as deleted by placing a # in their first column (replacing the first quotation mark). The _SESSION field is usually first, and it always starts with an x in this version of the CGI programs. This is only used on PocketPC and Windows, because we have trouble with duplicate session IDs on UNIX. This done for purposes of on-line reporting. It does not affect the index files, nor does it speed up queries. Data saving will be slightly slower (but that shouldn't be a problem on a PocketPC).
  • In JavaScript, [ if (FIELDNAME == '') ] and [ if (FIELDNAME == undefined) ] will return true if FIELDNAME has not been defined. The [!=] and [ne] operators may be used as well as the [==] comparison.
  • The last page in a form sends a SUBMIT action, which is subject to validation. Save and quit sends a SAVE action, which runs the validation, but does not block submission.
  • Fixed buffer overrun in HTMLSend()
• 4.54
  • Compiles under MingW
  • Reorganize compile options
  • Remove __CONSOLE__ definitions.
  • Look for FASTCGI, WINCGI, ISAPICGI, or default (nothing defined)
• 4.53
  • bring back C++ style comments (//) in JS
  • removed SendDataToEmail
  • get counts from a local .ini file (Windows only)
  • toFixed(number,digits) function
• 4.52
  • added sendMail, runReport, findRecord methods to js
  • JS uses "ScriptEnvironment" object
  • add <> to SMTP RCPT command
• 4.51
  • <ezs report> queries use full logical evaluation (careful with quotes!)
  • <if "query"> <else> <endif> added
  • 'has' operator added to search token lists
  • findRecord js method added
• 4.5 EZS 2002
  • read next page from .val file. Going back doesn't
  • Streamline dbadmin -- downloads ASC only.
  • Revise LIST program
  • Multi-mode save
  • Formmatted reports
  • Summary reports
• 4.3 Add .NET support with SOAPExec()
• 4.2 Improved efficiency, security
  • Remove IsCGI, Count, and Security variables from CGIMain. "argv" is guaranteed to be a non-null list of CGINameValue records.
  • Applications should check security with GetSecurityFlags().
  • Allow/Deny authentication is removed from the CGI programs, as this is better handled by the web server. You can define CGI_ALLOW when compiling to restore this feature.
  • define EBCDIC to allow EBCDIC/ASCII format conversion (requires separate compile with EBCDIC defined)
  • DEBUG tracing of output
  • Algebraic expression evaluator handles whitespace better
  • ReadPairedString and ReadPairedValues initialize reserved slots with blank data.
  • compile with CGI_FAST to disable slow startup logging
  • If there is no variable named "x", then x will evaulate to a null string.
• 4.1 Improved security in cgi_ezs.c
• 4.0 Add ODBC support and a limited JavaScript-like server-side parser. change logic evaluation rules: field=$field and field==field will continue to be interpreted in the same way, but for field=x, x will be considered a literal only if:
  • x is a number of the form 123, [+-]123.456, .4e[+-]12
  • x is a quoted string (single or double quotes OK)
  • there is no variable named "x" changed the syntax of ReadUntilWord to match ReadUntilChar NewStream() etc... functions NewBuffer() etc... functions
• 3.0 Rename header file to cgi.h, don't strip newlines from form data until it's saved, consolidate most functionality into ezs.cgi, reformat comments for Doxygen.
• 2.5 Add SendMail() for Windows and UNIX
• 2.0 Global settings go in cgi.ini, IFM prefix -> CGI, files renamed cgi_* support for the OpenMarket fastcgi interface
• 1.6 CodeWarrior compilation support
• 1.5 More descriptive error messages. Nobody ever knew what "Error 5" meant
• 1.0 Use long file names for Windows. Previous versions used 8.3 names. The header file is still "intrform.h" however.
• 1.0 Add HTML parsing in ifm_html.c. (neato!)
• 0.9 MSC: define WIN32, and __CONSOLE__, if desired

Raosoft EZReport, EZSurvey, InterForm, RapidReport, Raosoft, and SurveyWin are registered trademarks of Raosoft, Inc. Page contents © 1996-2007 by Raosoft, Inc. You may use and modify this file for your own use, but may not distribute it or derivative works without the prior written consent of Raosoft, Inc. This software is provided "as is," and Raosoft makes no warranty, express or implied, of fitness for a particular application. Every measure has been taken to anticipate risks inherent to computer networks, but we cannot guarantee safety or reliability of this program in every situation.

Tel: 206-525-4025 (US) Email: raosoft@raosoft.com
http://www.raosoft.com/