🜃 Minimal CGI Script

177 2026-08-01 snippet ♈︎ ♄︎

The whole CGIThe Common Gateway Interface is a 1993 protocol for running a program per HTTP request, standardized in 2004 as RFC 3875. The server forks a process, passes the request in as environment variables and stdin, and reads headers plus a… contract in one script: read the environment, print headers, print a blank line, print a body.

#!/usr/bin/env python3
import os

query = os.environ.get("QUERY_STRING", "")

print("Content-Type: text/plain")
print()
print(f"Hello from CGI. Query string: {query}")

Apache or any CGI-capable server sets QUERY_STRING, REQUEST_METHOD, REMOTE_ADDR, and the rest of RFC 3875's meta-variables before exec'ing the script.

Never do this in a shell script, sandboxing backticks against injection is close to impossible. See CGI in 2026CGI never fully died, it retreated to admin tooling and old Apache corners. Jake Gold benchmarked compiled-language CGI at 2,400+ requests/sec, half a billion a day, once you're not spawning an interpreter per request. The Navigator project revived real CGI… for the rest of the security story.