🜃 Minimal CGI Script

231 2026-08-01 snippet ♈︎ ♄︎

The whole CGIThe Common Gateway Interface is a 1993 protocol for running a program per HTTP request, standardized in 2004 as RFC 3875. The server forks a process, passes the request in as environment variables and stdin, and reads headers plus a… contract in one script: read the environment, print headers, print a blank line, print a body.

#!/usr/bin/env python3
import os

query = os.environ.get("QUERY_STRING", "")

print("Content-Type: text/plain")
print()
print(f"Hello from CGI. Query string: {query}")

Apache or any CGI-capable server sets QUERY_STRING, REQUEST_METHOD, REMOTE_ADDR, and the rest of RFC 3875's meta-variables before exec'ing the script.

Never do this in a shell script, sandboxing backticks against injection is close to impossible. See CGI in 2026CGI never fully died, it retreated to admin tooling and old Apache corners. Jake Gold benchmarked compiled-language CGI at 2,400+ requests/sec, half a billion a day, once you're not spawning an interpreter per request. The Navigator project revived real CGI… for the rest of the security story and Shell Script CGI SecurityShell scripts are risky for CGI because sandboxing backticks against injection is close to impossible. The minimal-cgi-script note explicitly warns against shell script CGI for this reason. For the guestbook system, the shell script runs locally on the tilde server,… for more on why shell scripts are particularly risky.