Live data from Hacker News

Web development in C: Crazy?

medium.com

31–40 of 213 posts

Re: Web development in C: Crazy?

#32
I wrote a small (~300 line) C program to scrape an email and insert the part I wanted into a Postgres database. I used PCRE for the extraction and ECPG for the Postgres part. ECPG stands for embedded SQL in C for Postgres, and it looks like this:

    // Open the storage subsystem.
    void open_storage()
    {
      EXEC SQL BEGIN DECLARE SECTION;
      const char* database = DATABASE_NAME;
      const char* username = USERNAME;
      const char* schema = SCHEMA;
      EXEC SQL END DECLARE SECTION;

      EXEC SQL WHENEVER SQLERROR CALL quit();
      EXEC SQL CONNECT TO :database USER :username;
      EXEC SQL SET search_path to :schema;
    }
ECPG: http://www.postgresql.org/docs/current/interactive/ecpg.html

My takeaway was that it was a lot easier than I expected, but it was still kind of a minefield. ECPG isn't widely used or highly intelligent, so there are a lot of stumbling blocks despite the pretty high quality documentation. I would recommend hiding your ECPG behind some functions so you only have to run some of your files through the pre-processor. But it is a neat tool and I could see myself using it again.

Re: Web development in C: Crazy?

#33
post #5

So, people can't hardly write safe web apps in PHP without spraying XSS and auth bypasses and arbitrary shell executions and arbitrary SQL injections everywhere, and you also want to hand the attackers the ability to segfault your server or possibly even straight-up run arbitrary code? Anyone smart enough to truly safely code a website in C is smart enough to learn a language to create that website which doesn't get…

Seems like the rules for C web development are the same as for any other language: don't trust user input, and delegate the sanitization to vetted library functions. It's not like it's 1991 and you have to use plain arrays and strcmp; there are really good, safe libraries for these things.

That said, doing web development in a language with neither a REPL nor built-in unicode support sounds like a Bad Time.

Re: Web development in C: Crazy?

#35
post #5

So, people can't hardly write safe web apps in PHP without spraying XSS and auth bypasses and arbitrary shell executions and arbitrary SQL injections everywhere, and you also want to hand the attackers the ability to segfault your server or possibly even straight-up run arbitrary code? Anyone smart enough to truly safely code a website in C is smart enough to learn a language to create that website which doesn't get…

I'm not sure it's that cut and dry. For one thing, PHP itself has vulnerabilities, as do its flagship apps. These vulnerabilities are easy to scan for, because the default configuration advertises that it is there and what version it is. If you're worried about some kid running scripts or idly scanning, you're probably in better shape with a custom C program than with a widely-used PHP program, even though the custom C program is likely to be more fragile and crumple more easily under actual expert attention.

Re: Web development in C: Crazy?

#36
The Fossil DVCS has a built-in web interface for reviewing commits, along with a bug tracker and a wiki. It's all written in C, albeit with a couple of custom macro preprocessors.

I once wrote a toy web page in C; Lex made for nice HTML templating and with pseudOO it actually felt pretty modern, but I still wasted a whole lot of time reinventing various wheels.

Re: Web development in C: Crazy?

#37

WHYYYYYYYYY No, seriously, why ? As far as I can tell, his entire argument is "web development in C is terrible and limiting, but not as quite as terrible and limiting as you might think." I guess that's good news if terrorists are forcing you to write websites in C, but I don't see even an attempt at explaining why you would choose to do this.

Maybe your problem is CPU-bound. Maybe there are good C libraries that solve your problem. Maybe you just want to learn C better. Maybe you have latency limits you need to work within. Maybe you just want to be contrary. Sometimes "why not" is worth more than "why."

Re: Web development in C: Crazy?

#38
I once inherited a website written in C. I actually tried moving it to PHP but the server was hitting a rogue MySQL instance with a file socket and I couldn't find a PHP API to handle it.

There were two things I did that actually made it pretty painless to work with: I implemented a Dreamweaver template processor that you could hook up to output a string or execute a block on each template element. I also implemented a preprocessor that allowed injection of large HTML blocks:

    for (int i = 0; i (((i))). {{{strings[i]}}}]]]
    }
It's an interesting exercise, but as soon as I left they scrapped it for something maintainable.

Re: Web development in C: Crazy?

#39

WHYYYYYYYYY No, seriously, why ? As far as I can tell, his entire argument is "web development in C is terrible and limiting, but not as quite as terrible and limiting as you might think." I guess that's good news if terrorists are forcing you to write websites in C, but I don't see even an attempt at explaining why you would choose to do this.

Maybe your problem is CPU-bound. Maybe there are good C libraries that solve your problem. Maybe you just want to learn C better. Maybe you have latency limits you need to work within. Maybe you just want to be contrary. Sometimes "why not" is worth more than "why."

Pretty much any decent language has a way to call out to C. I wrote a portion of a book on Tcl's C API, for instance, and it's very easy to farm out computationally intensive work to C code, as it is in Python, Ruby and most other things, one way or the other.

Re: Web development in C: Crazy?

#40

At my first web job circa 1996, our shopping cart product was mostly C, so I did web development in C for about two years. I'm not sure that using C was the craziest thing about how we did things. Nobody really had an idea how to structure a web app, so it was more or less a dozen or so CGIs which read/wrote to flat files through custom-written dbm clone (woo, NoSQL in '96!). Lots of unsophisticated string munging. M…

You should have used lisp :p
Post reply on HN