Papers in PDF format

Database
2. Review of Related Work
Query
Routines
Swap
Secure
Loop
CGI
HTTPD
Users
Figure 1: General System of Databases with Web Front-Ends
2.1 Web Accessible Database Authoring Tools
There are many tools available to create Web-accessible database applications. Many of these systems use
some proprietary code combined with HTML. The most comprehensive authoring tools that we have seen at
this time are Sapphire/Web [Bluestone 1995], Cold Fusion [Allaire 1996], WebBase [ExperTelligence 1995],
and Web.SQL [Sybase 1996]. Each of these tools follow a slightly different path. Some focus on ease of
database queries, or facilitate the transfer of form information to the scripts; others provide mechanisms to
integrate HTML, SQL, and Perl. Still, none of these packages deal with every component of Web/database
design.
It should also be noted that these products, when they support it, use proprietary techniques to maintain state
and provide password protection. In this paper, it is our intention to explain and formalize some of the
techniques that could have been used by these products to achieve their results. Future developers should see
that it is possible to efficiently create complex databases without the use of external libraries or licensed code.
2.2 Maintenance of State and Password Protection
Unless information can somehow be associated with a user, Web documents are stateless, meaning that the
execution of one CGI script will not effect the execution of another. [Gleeson & Westaway 1995] Two popular
methods of imposing state are the use of hidden fields and the use of ‘cookies.’ [Netscape 1996a] The greatest
danger with hidden fields is that a malicious user can view the HTML and modify the data in the hidden
fields. Cookies stored locally can also be modified and are not supported by all browsers.
One solution is provided by a language called “Linda” created by Schoenfeldinger. [Schoenfeldinger, 1995]
Linda records tuples among processes running in parallel on distributed systems. We simplify this concept by
allowing CGI scripts to save tuples pertaining to state into what we call the “swap.”
2.3 Password Protection of Document Trees
Many of the newer versions of Web servers allow password protection at a directory level, but this will not
control how authorized users access the pages in that directory. MembersOnly is a system that allows
document level access control. This system requires the use of a third party HTML server. [GATE
Technology 1995] Neither of these systems permit conditional access to pages which may be required for
database applications.
3. The Secure Loop