Apache Week
   

Copyright 1996-2005
Red Hat, Inc.

First published: 7th March 1997

Feature: Dynamic Page Languages

When choosing how to generate dynamic pages there are serveral things to consider:

  • Performance: dynamic pages require more work on the server, so are less efficient than static files, but some types of dynamic pages are more resource efficient than others.
  • Complexity: dynamic features can be generated from relatively simple code build into HTML pages (called "embedded"), through to self contained programs written in C or perl, using the CGI interface.
  • Security: some methods of generating dynamic pages allow you to use a programming or scripting language on your server. There is a risk of letting users access things on your system that they should not do if the pages are poorly written.

Traditionally there were three ways of getting dynamic pages on your site: use "server side includes" (SSI) inside HTML pages, use a scripting language such as Perl or PHP, or use a compiled programming language such as C or Pascal. Both scripts and compiled programs were accessed using "CGI". But the distinctions are becoming more blurred. SSI as implemented in Apache 1.2 now has variables and conditional execution, making it more like a scripting language, while the PHP scripting language can be embedded into HTML pages. There is even a module to embed perl commands into HTML pages.

Also, many scripting languages can be built into Apache as Apache modules, rather than using CGI. This makes executing the scripts much more efficient, since an interpreter does not need to be started for very request.

Complexity

There are two ways to get the server to run your programs: either embed a script into an HTML document, or create a standalone program which makes use of the CGI interface. Embedded scripts are easier to write but restrict you to the languages available for embedding, while CGI can be used with any language.

The traditional embedded language is "Server-Side Includes" (SSI) but other scripting languages are available which can be embeded. Embedded commands are executed by the server before it serves the page to the client (so serving HTML pages containing embedded commands is slower than serving straight HTML pages). Embedded pages can be processed either by an Apache module or a CGI program. Using a module will be much faster. Languages available for embedded use include SSI, PHP, Perl and NeoScript (of these, SSI is built into Apache by default, while the others require a new module to be compiled in).

The alternative to embedding the commands into HTML is to write self-contained programs. These usually use the CGI, or Common Gateway Interface, to work with the server. The CGI specification says how servers should talk to the script or program and how the script or program formats its reply for use by the server. CGI is not a language itself. If you know the CGI protocol you can write programs for use with a web server in any language.

Performance

If you want better performance from your pages (by performance we mean low use of resources, resulting in more pages served more quickly), you should use either a pre-compiled language (such as C) and CGI, or a scripting language which is available as an Apache module. In the case of the perl and python modules, preload scripts or data that will be used often. If you are thinking of using CGI, you might consider using FastCGI instead. FastCGI is an alterative method of running programs from a server which has several new features and is more efficient than normal CGI. If your CGI is in perl, think about using mod_perl to pre-load the perl scripts (and, where possible, to open database and similar connections when Apache starts and re-use them across multiple requests).

Of course the best performance can be obtained by using static pages instead of dynamic ones. You might consider pre-generating HTML files, rather than serving up dynamic pages if possible. For example, if your readers access pages from a database, it might be faster to export those pages into HTML every so often, rather than lookup the records in the database for every request.

Alternatively (or in addition) consider using a local cache in front of your Apache server. The client would connect to the cache first, and if that page has already recently been requested, the cache would return it without calling the server. This sort of local cache is also called a "server accelerator". Your dynamic pages will have to be set up to allow them to be cached though (SSI pages, for example, are usually not cacheable).

Security

Security is a very important considerable when thinking about dynamic pages. All CGI programs, both scripted and compiled, are potentially insecure. You have to be very careful when writing CGI programs, for instance, to ensure that Internet users cannot execute programs on your server or read files they should not have access to.

Another security issue which might be important is related to other local users. For example, you might want to let your customers or colleagues use a dynamic language. But if you let them write CGI programs they could write a program which accesses other people's files (since by default all CGI programs run as the same user). More limited scripted languages (such as SSI) might be safer in this situation.

Dynamic Page Languages

Finally, here is a reference list of ways of including dynamic pages on your site.

Language Embedded? Apache Module? Description
SSI Yes Yes Traditional "Server Side Includes" allow simple dynamic pages. Apache 1.2 extends SSI to include variables and conditional code. Already part of Apache. Because of the restricted range of commands this can be more secure than other languages, and Apache has the ability to turn off some less secure features.
PHP Yes Yes A more comprehensive embedded language than SSI, with built-in support for many databases (such as mSQL, mySQL, DBM), page counters.
NeoScript Yes Yes An embedded scripting language based on Tcl.
Meta-HTML Yes No An extended version of SSI.
Python No Yes Python is an interpreted object-orientated language. This module builds the Python interpreter into Apache for better performance than normal CGI.
embedded Perl (ePerl) Yes No Perl is a powerful general purpose interpreted (scripting) language. This module lets you embed arbitrary Perl commands into your HTML.
mod_perl Yes Yes Perl is an advanced interpreted language. This very powerful module integrates Perl into Apache, letting you pre-load Perl scripts, re-use resource across multiple requests, and even write whole Apache modules in Perl. This gives you much more access to and control over the server than CGI programs in Perl (which this module also supports). The ability to write modules in perl makes it possible to extend the server's functionality relatively easily, without the complexity of writing a module in C.
Compiled languages (C, Pascal, Fortran, etc) No No Facilities available depend on language. Usually more efficient than scripted or embedded languages. Has to be written to use CGI protocol, or an equivalent such as FastCGI.
Scripting languages (Perl, Python, shell, etc) No* For Some Languages Facilities available depend on language. Unless an Apache module is available, has to be written to use CGI protocol. When using CGI is less efficient that compiled languages or scripting languages using an Apache module. (Note: * Perl can be embedded if eperl or mod_perl is used).
Java No Yes Use mod_jserv to call Java "servlets" from Apache.

Summary

It is impossible to recommend the "best" dynamic page language since what is best will depend on your needs. However some general conclusions can be drawn.

If you do not already know a scripting or programming language, use one of the embedded languages. SSI is probably the simplest, but PHP has some useful extra features.

If you want a language than is quick to develop in and efficient, use an embedded language such as PHP or embedded perl, or use perl with mod_perl. If you prefer other scripting languages, use one with an Apache module (e.g. python). If you already use perl CGI programs, consider moving over to using mod_perl, which will give you much better performance and more control over the server.

If you want a "full" programming language for arbitary programs, either use any compiled language (e.g. C) or use perl with the perl module. If you've been put off Perl because of concerns about performance, think again. The module makes it very efficient, and the ease of development and large range of add-on perl modules (packages) make developing applications more convenient. To make external CGI programs more efficient, use FastCGI instead of CGI, or write in Perl and use mod_perl. For Java programs, use mod_jserv.

The final way to make a top-performance dynamic page is to write an Apache module. This is complex and requires care to ensure that you do not "leak" resources or affect the rest of the server, but will give the best performance. Modules have to be written in C (although it might be possible to link in other languages). An alternative to writing modules in C is to use mod_perl, which lets you develop Apache modules in perl.


Comments or criticisms? Please email us at editors@apacheweek.com