Why does the page know your name?
You open a shop site. It says "Welcome back, Aisha". Your friend opens the same site. It says "Welcome back, Sam".
It is the same address. But the page is different. Somebody wrote code that builds each page when you ask for it.
How does the site remember you? That is today's puzzle.
Key words
| Word | What it means | Example |
|---|---|---|
| Dynamic page | A page that the server builds each time, from data. | Welcome back, Aisha |
| Static page | A page that is the same file for everybody. | |
| Form | A group of boxes on a page where the user types data and presses Send. | |
| Query string | Data added to the end of an address, after a question mark. | ?name=Sam&age=15 |
| Stateless | Does not remember anything from one request to the next. | |
| Stateful | Remembers what happened before. | |
| Session | The server's memory of one user, kept between requests. | |
| Cookie | A small piece of text the server gives to the browser. The browser sends it back each time. | |
| Front end | The part of a program that the user sees, in the browser. | |
| Back end | The part of a program that runs on the server. | |
| HTTP | The rules a browser and a server use to talk to each other. | |
| Escape | Change special signs, such as <, so the browser shows them as text and does not run them. | |
| Validation | Checking that data is sensible before you use it. | |
| HttpOnly | A cookie setting. JavaScript on the page cannot read this cookie, so it is safer. |
The cells students fill in are left blank in this preview.
Static and dynamic pages
A static page is a file. Everybody gets the same one.
A dynamic page is built when somebody asks. The server looks up data, such as your name or your basket, and puts it into the HTML.
Try it: build HTML from data
from html import escape
items = ["Tea", "Milk", "Biscuits"]
rows = ""
for item in items:
rows = rows + "<li>" + escape(item) + "</li>"
print("<ul>" + rows + "</ul>")
# Add an item that has a < sign in it. See what escape() does.
Always escape user text
data-callouts.warning.label
If a user types <script> into a box and you put it straight into the page, their code runs in other people's browsers. Use escape() on all text from users. It turns < into <, so it shows as text and does not run.
Quick check
Have a go
Quick check
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Forms send data
A form sends what the user typed to the server. The data arrives as text, like name=Sam&age=15.
The back end must split the text into parts and then validate it. Never trust a form. A user can send anything, even if your page has checks.
Try it: read form data
from urllib.parse import parse_qs
body = "name=Sam&age=15"
data = parse_qs(body)
print(data)
print(data["name"][0])
# Each value is a list. Change age to abc. Can you check it is a number?
print(data["age"][0].isdigit())
The web forgets
The web is stateless. Each request is new. The server does not know that you were here a second ago.
To remember you, the server gives your browser a cookie. The browser sends it back with every request. The server reads it and finds your session, its memory of you.