HTML & Sinatra Forms Question

[Max]

Hey,

I was hoping you folks could shed some insight onto parsing data from
HTML forms in my webapp (written in Sinatra and Sequel). I'm
relatively new to HTML, but I understand that once you enter data into
the form and submit it, you're redirected to an .asp page. My plan
afterwards is to somehow parse the URL from the page you're redirected
to and extract the form data from it. This seems like a clunky
solution, but I haven't been able to find anything else promising
online. Here's the code I've written, if I'm being unclear:

<form name="add_person_form_name" method="get"
action="add_to_db_form.asp" method="get">

Type your first name here:
<input type="text" name="fname_form" size="20"><br>
Type your last name here:
<input type="text" name="lname_form" size="20"><br>
Type your current town here:
<input type="text" name="town_form" size="20"><br>
Now, say the magic word...<br>
<input type="submit" value="Please">

</form>

Let's say the user is named John Doe and lives in Chicago... once the
user fills in their data and presses "Please," they are redirected to
http://localhost:4567/add_to_db_form.asp?fname_form=John&lname_form=Doe&town_form=Chicago.
I can make a get-routine to tell Sinatra what to do when this happens,
but I don't know how to intercept the URL and parse it.

I suppose my main question is, am I taking the right approach for
this? Is there an easier way to get data from the user with HTML
forms and Sinatra (and Sequel, although I know this isn't the right
board to ask about Sequel)? Something tells me there has to be a much
easier way, but I haven't found anything relevant online. If I am
taking the right approach, how do I parse through the URL? In
addition, how would I check for buffer overflows or SQL injection when
using these kinds of forms?

[beenimble]

Max,

I think the first question most folks here will ask you is, does your
project require you to use or interface with an existing (Microsoft)
ASP page or application? Or do you just need to collect and store data
from users?

From your post it seems like you just want to save form submissions.
If so, you might want to start here:

http://www.sinatrarb.com/book.html

And you can find a sample Sinatra/Sequel application here (I'm not
sure if it's fully compatible with the current versions of Sinatra and
Sequel, but it should still be relevant):

http://github.com/jeremyevans/giftsmas/tree/master

If that doesn't help post some more information and I'm sure someone
can point you in the right direction.

[Max Rozentsveyg]

Dang, I completely passed over that part of the book.  That answers my question quite nicely.  To answer your first question though, I just needed to store the information on my machine.  Thanks for the link to the giftsmas app, too.  I'm going to put into effect what's in the book right now, though.
-Max

[beenimble]

I haven't tried it but in case it helps there's a semi-recent tutorial
using Sinatra and Sequel here (with SQLite as the data store):

http://carlosgabaldon.com/ruby/bets-placed-by-sinatra/

But really I'd start with http://www.sinatrarb.com/book.html and build
up your app from there; one of the nice things about Sinatra is you
can make your application as simple or complicated as you like without
being encumbered by superfluous code.

[Max Rozentsveyg]

Cool, thanks for the tutorial.  I've looked at the book before, but I suppose when I started writing more difficult examples, I intuitively looked to the API page for assistance, although it's less helpful.  In regards to buffer overflows and SQL injection, are these things I should be worried about?
-Max

[beenimble]

> In regards to buffer overflows and SQL injection, are these things I should be worried
> about?

Well yes, but no. ;)

I believe Sequel handles string escaping, and if you want to escape
output there's an example here:

http://www.sinatrarb.com/faq.html#escape_html

Buffer overflows are more of a general Ruby topic--I'd try a web
search or http://groups.google.com/group/ruby-talk-google/ .

Hopefully others with more/better info will jump into the discussion.

[Max Rozentsveyg]

Alright, I'll take a look.  I'm still having trouble getting forms to work, though.  I changed my code to:

    <form>

    Type your first name here:

    <input type="text" name="post[fname]" size="20"/><br>

    Type your last name here:

    <input type="text" name="post[lname]" size="20"/><br>

    Type your current town here:

    <input type="text" name="post[current_town]" size="20"/><br>

    Now, say the magic word...<br>
    <input type="submit" value="Please">
   
    </form>

like in the example, so now should I call params['post']['fname'] and such in that same routine, at the end?  When I do, I get a nil class exception.  I noticed that the URL changes to "http://localhost:4567/add?post[fname]=...", so then I tried making a route that matched that URL with a regex (/add\?post\[fname\]=*) which called the params hash, but that didn't work, either.  How should I go about extracting the data?  In addition, is there a better way for me to learn Sinatra instead of finding an example in the Book each time I get stuck?

-Max

[beenimble]

S'more links:

http://www.rubyinside.com/sinatra-29-links-and-resources-for-a-quicker-easier-way-to-build-webapps-1371.html

In particular you might want to check out:

http://blog.zerosum.org/2008/7/2/clone-pastie-with-sinatra-datamapper-redux

Do you see how the post is handled in the code block? Like:

http://pastie.org/538821

The example uses DataMapper instead of Sequel, but no matter which ORM
you use (if any), your code should end up looking something like that.

The only difference is you're using nested form parameters (http://
www.sinatrarb.com/book.html#nested_form_parameters) so you'll grab
values like params['post']['fname']. Also the example route points to
the site's root, while yours points to '/add'.

[Max Rozentsveyg]

Where I would call params['post']['fname'] to process it?  The example uses erb to handle input and output, but how would I do it with just HTML and nested forms parameters?
-Max

[Max Rozentsveyg]

Further, how would I integrate non-nested form parameters into my app to do the same thing?  The Book example doesn't help much.  What other programming languages should I research to get a better grip on Sinatra?  It seems that most of the examples I find assume I'm more knowledgeable than I am.
-Max

[Tanner Burson]

Well, Sinatra isn't a programming language, it's a minimal web framework written in Ruby.  The issues you seem to be grappling with are less about Sinatra itself, and more about the basics of how web applications are structured.  Everyone on this list has been through the same learning experience at varying points.

I'd really recommend reading some of the various tutorials on http://www.w3schools.com for HTML, Javascript, and probably something like PHP.  This will give you a better understanding of how the various parts of the process work together to create a web application.  Once you have a solid understanding of things like HTTP verbs, forms, etc, then Sinatra should be a lot easier to get your head around!

Hopefully that gets you pointed in a more helpful direction.

--Tanner

--
===Tanner Burson===
tanner...@gmail.com
http://www.tannerburson.com

[Max Rozentsveyg]

Tanner,

Thanks for the suggestion.  I read the HTML and Javascript tutorials today, and PHP seems easy enough to understand the gist of.  I'm also familiarizing myself with the verbs, but right now I'm trying to get a grip on CSS and the other things I mentioned, along with haml.  Thanks for the all the advice you guys.  Hopefully I'll be able to figure out forms with Sinatra afterwards.

-Max