Given by Geoffrey C. Fox (Tom Scavo) at CPS616 Technologies of the Information Age on Spring Semester 99. Foils prepared 11 March 99
Outside Index
Summary of Material
Cookies -- Store and Access information stored on client machines |
LiveConnect -- Link Java and JavaScript |
LiveWire -- Server Side ECMAScript |
More advanced ways of defining, laying out and controlling web documents:
|
Outside Index
Summary of Material
Geoffrey Fox |
Northeast Parallel Architectures Center |
Syracuse University |
111 College Place |
Syracuse, NY 13244-4100 |
http://www.npac.syr.edu/projects/tutorials/JavaScript/ |
http://www.npac.syr.edu/users/gcf/javascriptIImarch99/ |
Cookies -- Store and Access information stored on client machines |
LiveConnect -- Link Java and JavaScript |
LiveWire -- Server Side ECMAScript |
More advanced ways of defining, laying out and controlling web documents:
|
A cookie is operationally a relatively small named string stored by the browser and a property of the Document object |
The cookie mechanism gives the browser a kind of memory, that is, a cookie "saves state" |
Originally, only CGI scripts could read/write cookie strings, but with JavaScript, cookies can be handled entirely on the client side |
A cookie
|
Cookies were introduced by Netscape to preserve client side state |
If you have a CGI script that services several clients (ordering T Shirts perhaps), it is neatest to use client and not server to store information such as name of user, passwords etc. |
Traditionally saved state in forms for a session preserved using "hidden" fields
|
Such hidden fields are passed to CGI scripts in same fashion as other variables set in form text fields |
hidden values can either by set by JavaScript on client side or returned built into a page constructed by CGI script which might read N values and return a new form with M new fields for client to fill in and N old entries preserved in hidden fields |
So hidden variables are nice but only preserved as long as you keep to page you started with or that returned by CGI script. |
Cookies provide an alternative mechanism to hidden files where information is saved in special file on client (called cookies or cookies.txt)
|
Such files can preserve information in a more robust way than hidden alternative! |
Cookies are supported by Microsoft and and Netscape and can be used (like forms) for pure client-side or client-server activities |
Neither hidden or cookies are very secure |
Cookies have 5 attributes -- name, expires, domain, path and secure and are specified by a single line that must specify a value for name but where all other attributes are optional. |
name=value; EXPIRES=datevalue; DOMAIN=domainname; PATH=pathname; SECURE |
name is required and tells you name of cookie |
EXPIRES is optional but if present specifies a date after which cookie is to be deleted |
EXPIRES uses a modification of syntax returned by JavaScript function Dateobject.toGMTString()
|
It appears that one can just use the slightly different syntax of toGMTString as well as "official format"
|
DOMAIN defaults to domain of server where cookie set and general matching matching is done starting at end of domain
|
PATH=/ is most general path and matches all paths but default is again path of document that set cookie.
|
SECURE if present requires a secure communication channel |
The Brower passes to server any cookies that are valid for a given page in HTTP header |
Note only name=value is passed because PATH DOMAIN SECURE and EXPIRES are used to check if cookie should be passed |
The server stores cookie strings in $HTTP_COOKIE environment variable as name1=value1; name2=value2;
|
One can send cookies back to client using Set-cookie: name1=value1; expires= .. ; domain= ...; etc. before the content-type: text/html header line |
JavaScript string object document.cookie holds cookies that are valid for this document and can be used to either set or retrieve cookie values |
In WebWisdom example, we have pages with a form that sets values of parameters common to several foils and stores for a certain length of time. This is entirely processed client-side with JavaScript interpreting form and storing values in appropriate cookie entries |
These cookies are read on other pages (consistent with PATH and DOMAIN) and if present used to define JavaScript variables that are used in "parameterized HTML" |
Note document.cookie is set to a single cookie value but when read gives all cookies for this document! |
A cookie string may not contain semicolons, commas, or whitespace (use escape() and unescape()) |
There are some Size Limitations:
|
When browsing the Web, two pieces of information are considered public: the IP address of the client and the type of browser. All other data are considered private. In particular,
|
An important bug fix appeared in NN2:
|
See this URL for an interesting account: http://www.osf.org/~loverso/javascript/ |
For example, a script from home.netscape.com may not read the properties of a document loaded from developer.netscape.com |
The document.domain property is initialized to the hostname of the server from which the document was loaded |
This property may be set to any valid domain suffix of itself |
For example, if document.domain is "home.netscape.com", it may be set to "netscape.com" (but not "ape.com") |
Data tainting, an alternative to the Same Origin Policy, was experimentally implemented in NN3.0 |
Data tainting allows access to private data (e.g., history[] array) but forbids "export" of this data over the Internet |
Both data and methods may be tainted
|
Tainting was extremely clumsy and has been disabled in NN4, in favor of signed scripts |
A new security model called signed scripts was implemented in NN4.0 |
Signed scripts are based upon the Java security model for signed objects |
The following objects may be signed:
|
Scripts are signed using Netscape's Signing Tool (signtool), a command-line utility that creates digital signatures for Java class files, JavaScript scripts, plugins, etc. |
Scripts may be served from a secure (SSL) server, in which case they're treated as if signed with the public key of that server |
Users retain the right to deny the privileges requested by the signed script
|
A certificate is an electronic document used to identify an individual or organization |
An object-signing certificate is a special kind of certificate that allows you to associate your digital signature with one or more files |
A digital signature is analogous to a handwritten signature (that is, it is difficult to refute and may be legally binding) |
NPAC has a Software Developers Certificate from a company VeriSign which one uses to sign "official NPAC" Java or JavaScript
|
Signed objects are packaged in a JAR (Java Archive) file, a sort of "digital envelope" based on the ZIP archive format |
Using signtool, one associates digital signatures with the files in a JAR, which:
|
First check to see what object-signing certificates are available: % signtool -l |
If none are available, a test certificate may be created with the command: % signtool -G MyTestCert |
To sign scripts in directory "signdir", type: % signtool -k MyTestCert -J signdir |
So this is only DOS program I run on my PC! |
First, identify inline scripts to be signed: <SCRIPT ... ARCHIVE="some.jar" ID="1"> |
The script ID must be unique in the JAR |
JavaScript source files don't need an ID: <SCRIPT ... ARCHIVE="some.jar" SRC="file.js"> |
Note: Only one ARCHIVE attribute per document is necessary, in which case all signed objects are stored in a single JAR |
Signed scripts may request expanded privileges |
For example, to access private data: netscape.security.PrivilegeManager. enablePrivilege( "UniversalBrowserRead" ); |
"UniversalBrowserRead" is just one of many target privileges that may be requested
|
Unsigned Scripts and Signed Scripts can NOT be mixed in same document |
One access methods in signed scripts from unsigned scripts (in a different layer or window) as long as signed script exports method and using script imports it
|
LiveConnect is a Netscape communications protocol between Java applets, plugins, and JavaScript |
A JavaObject is a JavaScript wrapper around a Java object; a JSObject is a Java wrapper around a JavaScript object |
MSIE3.0 does not support LiveConnect; instead, applets are treated as ActiveX objects, but fortunately the basic syntax is the similar |
With LiveConnect:
|
LiveWire is Netscape's proprietary alternative to CGI, which lets developers create database applications in JavaScript (ECMAScript) |
It consists of two components: a compiler and a server extension (both require Netscape's Enterprise Server) |
Server-side JavaScript is used to connect to and interact with a database server |
A server-side object called DbPool lets you (efficiently) connect to multiple databases or multiple times to a single database |
Client-side JavaScript is contained in <SCRIPT> tags; server-side JavaScript is contained in <SERVER> tags and must be pre-compiled on the server |
XML Complete, Steven Holzner [McGraw-Hill, 1998, ISBN 0-07-913702-4] |
"XML, Java, and the future of the Web", Jon Bosak, Sun Microsystems, 1997 |
"Weaving a Better Web", S. Mace, U. Flohr, R. Dobson, T. Graham, Byte, March 1998, pp.58-68 |
http://www.w3.org/UI/ W3C Consortium User Interface |
Dynamic HTML, The Definitive Reference by Danny Goodman (1st ed, O'Reilly, 1998). |
NPAC's HTML Resources page, http://www.npac.syr.edu/projects/tutorials/HTML/ |
HTML = Hypertext Markup Language
|
HTML 2.0 spec completed in Nov 95 |
HTML+ and HTML 3.0 never released |
HTML 3.2 (Jan 97) added tables, applets, and other capabilities (approx. 70 tags) |
HTML 4.0 spec released in Dec 97 |
HTML is simple and thus easy to learn |
HTML Supports Hyperlinks |
It is relatively easy to write an HTML parser |
Everybody knows it! |
Extensibility: HTML does not allow users to define new tags and attributes |
Structure: HTML can not be used to model hierarchical or object-oriented data structures, such as those found in databases |
Validation: HTML does not support data validation or check for document structure |
HTML supports only the simplest links, that is, one-way links to physical web resources |
HTML does little to facilitate indexing, searching, and data interchange |
HTML has weak internationalization |
HTML has no technical typesetting capability |
HTML does a poor job of differentiating between presentation and content |
The logical design of a document (content) should be separate from its visual design (presentation) |
Separation of logical and visual design
|
HTML mixes the logical with the visual |
Internal Representation of Microsoft Word will/should be XML while "Save As HTML" should gives its visual rendering in HTML |
XML = eXtensible Markup Language |
XML is a subset of SGML -- Standard Generalized Markup Language, but unlike the latter, XML is specifically designed for the web |
XML is used to define logical document structure |
XML is not backward compatible with HTML, but the two coexist quite elegantly |
XML can be thought of as an ASCII version of a database |
XML is a compromise between the non-extensible, limited capabilities of HTML and the full power and complexity of SGML |
XML Tags are converted to HTML (or other XML tags) by one or more Servers or clients |
HTML < XML < SGML |
(CSS) (XSL) (DSSSL) |
XML is a kind of SGML Lite! |
Original |
XML |
New XML |
and perhaps some HTML |
Newer XML |
and perhaps more HTML |
Newest XML |
and perhaps all HTML |
H T M L |
Document Type Definition (DTD), which defines the tags and their relationships |
Extensible Style Language (XSL) style sheets, which specify the presentation of the document |
Extensible Link Language (XLL), which defines link-handling details |
It will have scripting language e.g. ECMAScript |
For example a link can be defined in XML as <LINK> <TITLE>XML Recommendation</TITLE> <URL> http://www.w3.org/TR/REC-xml </URL> <DESCRIPTION> The official XML spec from W3C </DESCRIPTION> </LINK> |
DHTML = Dynamic HTML |
Capabilities of DHTML:
|
It is available now albeit in different versions for different browsers |
It is an extension of HTML and therefore familiar |
It addresses many of HTML's shortcomings |
It is focussed at "visual display" of a document and so is orthogonal to XML |
We can expect DHTML to change significantly in both implementation and syntax
|
3 Scenarios |
HTML4 |
HTML4 |
User Interacts |
with HTML Changing Dynamically Client Side (JavaScript catches mouse |
and keyboard |
events and |
interprets as |
changed DOM components: |
Browser |
renders) |
XML |
HTML4 |
Server with XML Parser |
XML |
Some XML and some |
HTML4 |
HTML4 or XML+HTML4 Browser |
DHTML consists of the following:
|
The final spec for HTML 4.0 was released by W3C in December 1997 |
There are three flavors:
|
HTML 4.0 has 93 elements (10 deprecated) and 187 attributes (49 deprecated) |
Version 3.2 DTD: define by <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN" "http://www.w3.org/TR/REC-html32.html#dtd" > |
Version 4.0 DTDs: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN" "http://www.w3.org/TR/REC-html40/strict.dtd"> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd"> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Frameset//EN" "http://www.w3.org/TR/REC-html40/frameset.dtd"> |
More multimedia options |
Better printing facilities |
Better table support, especially long tables |
Internationalization and accessibility |
Style sheets and scripting languages |
Intrinsic events |
Embedded and linked documents |
A new <BUTTON> tag |
Most JavaScript 1.2 event handlers (except onAbort, onError, and the new window event handlers) are native to HTML 4.0 |
The <SCRIPT> tag is fully supported |
A <NOSCRIPT> tag has been added |
Some elements (tags) of HTML 3.2 have been deprecated in 4.0, including: <FONT>, <BASEFONT>, <CENTER>, <S>, and <U> |
Numerous attributes have been deprecated, including: ALIGN, BACKGROUND, BGCOLOR, LINK, COLOR, and SIZE |
The <APPLET> tag has been deprecated! |
Instead of <APPLET CODE="MyApplet.class" WIDTH=200 HEIGHT=300></APPLET> in HTML 4.0 we write <OBJECT CLASSID="MyApplet.class" CODETYPE="application/java" WIDTH=200 HEIGHT=300></OBJECT> |
The <PARAM> tag is still supported |
Nested objects are allowed |
http://www.w3.org/Style/CSS/ is general link |
Cascading Style Sheets (CSS1) allow more precise and consistent layout than previous HTML attributes such as <FONT> |
Style sheets permit pages to inherit properties from other pages--in effect, they permit object-oriented document structure |
CSS2 was released in May 98, and includes support for media-specific style sheets (e.g. printers and aural devices), downloadable fonts, element positioning and tables.
|
CSS1 allows one to specify layout styles (size, color, position) and associate in flexible way with tags |
Flexible placement of style information -- either in sheets (i.e. separate pages), attributes (style="..") or style statements in header of HTML page |
Independence from specific scripting languages but natural link to JavaScript |
Cascading style sheets i.e. one can have a hierarchy of style definitions from general to organization specific to user specific
|
Compact and so sensitive to network performance concerns |
Maintainable as isolates style information |
Works with XML and HTML |
A simple style sheet (in file "myStyle.css"): P.special { color: red; border: solid black; } |
Now put a <LINK> tag in the <HEAD>: <LINK href="myStyle.css" rel="stylesheet" type="text/css"> |
In the <BODY>, type: <P class="special">A special paragraph! |
Read in a style sheet and override a style: <HEAD> <STYLE type="text/css"> @import url(myStyle.css); H1 {text-align: center} </STYLE> </HEAD> |
Color a paragraph (not recommended): <P STYLE="color: green">A green paragraph! |
Selector |
Declaration |
<HTML> <HEAD> <TITLE>title</TITLE> |
<LINK REL=STYLESHEET TYPE="text/css" HREF="http://style.com/cool.css" TITLE="Cool"> |
<STYLE TYPE="text/css"> |
@import url(http://style.com/basic.css); |
H1 { color: blue } |
H2.vivid {color:pink} |
#myid {position:absolute; color:red; top:20; left:50; background-color:red; visibility:hidden} |
</STYLE></HEAD><BODY> |
<H1>Headline is blue</H1> |
<P STYLE="color: green">While the paragraph is green. |
<h2 class=vivid>And the secondary heading is Vivid</h2> |
<div id=myid> |
<h2>Default Color Positionable element</h2> |
</div> |
</BODY> </HTML> |
W3C DOM (http://www.w3.org/DOM/ ) defines a platform-independent programmatic interface to web documents:
|
Initially, DOM is bound to ECMAScript but is language neutral in design |
Current Browsers implicitly define a DOM which is somewhat different between Microsoft and Netscape and between versions 4 and 5 |
Here is an example of a source document encoded in HTML: |
<HTML> |
<TITLE>My home page</TITLE> |
<BODY> |
<H1>My home page</H1> |
<P>Welcome to my home page! Let me tell you about my favorite composers: |
<UL> |
<LI> Elvis Costello |
<LI> Johannes Brahms |
<LI> Georges Brassens |
</UL> |
</BODY> |
</HTML> |
Component Objects in Web Page |
Making dynamic pages with HTML and JavaScript requires two types of capabilities.
|
These capabilities EXIST in current browsers but are incomplete and different |
More powerful "standards" are part of W3C DOM1 and DOM2 and presumably these will be adopted |
In the meantime we adopt strategy which is supported by current browsers and can evolve to W3C DOM1,2 |
The first step is to define different named entities in document.
|
The position CSSP attribute takes values static (default) relative (position relative to where it "should be" in current "context") and absolute (position in current "context") |
These are properties of essentially ALL document components in the "DOM of our dreams"
|
// Set Flags to determine which browser is which |
WW_Netscape4 = true; |
WW_Microsoft = false; |
WW_oldbrowser = false; |
WW_setbrowser(); |
function WW_setbrowser() { // Set Browser Flags |
if( navigator.appName != "Netscape" ) { |
WW_Netscape4 = false; |
WW_Microsoft = true; } |
if( navigator.appVersion < 4 ) { |
WW_Netscape4 = false; |
WW_Microsoft = false; |
WW_oldbrowser = true; } |
} // End WW_setbrowser() |
<style type="text/css" > |
#WWmessage1 {position:absolute; color:black; visibility:visible; left:200; top:450; } |
</style> |
</head> |
<body onload="WW_pageisloaded();" > |
<h1>This is Page for CPS616 DHTML</h1> |
.... See page addon for full material (a form to specify layer properties) ..... |
<div id="WWmessage1" > |
This is a Moving Block of Text<br> |
Input (left,top etc.) and see! |
</div> |
Style |
Good Practice for all processing which requires that page elements be fully defined |
} |
A movable layer |
function WW_getlayer(idstring) { // Find layer with given label |
if( WW_Netscape4 ) { |
return eval("document." + idstring); } |
else { // Microsoft |
return eval("document.all." + idstring); } |
} // End WW_getlayer() |
function WW_layershiftto(obj,x,y) { // Move layer to given position |
if(WW_Netscape4 ) { |
obj.moveTo(x,y); } |
else { // Microsoft |
obj.style.pixelLeft = x; |
obj.style.pixelTop = y; } |
} // End WW_layershiftto(obj,x,y) |
WW_messageobject = WW_getlayer('WWmessage1'); |
WW_layershiftto(WW_messageobject,parseInt(x),parseInt(y)); |
id attribute in <div> #WWmessage1 in STYLE |
Returned by WW_getlayer |
Read in from form as text |
WW_setbackgroundcolor(WW_messageobject,cc); |
function WW_setbackgroundcolor(obj,actualcolor) { |
if( WW_Netscape4 ) { |
obj.bgColor = actualcolor; } |
else { |
obj.style.backgroundColor = actualcolor; } |
return; |
} // End WW_setbackgroundcolor(obj,actualcolor) |
WW_layertogeneric(WW_messageobject,75) // Set stacking index to 75 |
// At any point of window, object with largest stacking(z) index is shown |
function WW_layertogeneric(obj,stackingindex) { |
if(WW_Netscape4 ) { |
obj.zIndex = stackingindex; } |
else { |
obj.style.zIndex = stackingindex; } |
} // End WW_layertogeneric(obj) |
ASCII string such as "pink" setting dynamically object |
background color |
One can separately |
choose to hide layer |
or make it visible |
function processbutton3() { // Process content from form text field |
var inputstuff = WW_formlayer.document.classtest.textchoice.value; |
if(WW_Netscape4) { // Netscape |
WW_messageobject.document.open(); |
WW_messageobject.document.writeln(inputstuff); |
WW_messageobject.document.close(); } |
else { // Microsoft is much more elegant |
WW_messageobject.innerHTML = inputstuff; |
WW_messageobject.style.width = 300; } |
// Seemingly Netscape clips text layer to width of text; Microsoft to width of window; both clip vertical height to that of text; this is typical difference between |
today's erratic implementations of DHTML |
WW_layertotop(WW_messageobject); // Set layer zindex to 1000 |
WW_layershow(WW_messageobject); // Make layer visible |
return; |
} // End processbutton3() |
Note in Netscape full address is |
window.document. layer.document. property |
function WW_pageisloaded() { // Initialize when page loaded |
if(WW_oldbrowser) |
return; |
if( WW_Netscape4 ) { // Netscape |
window.captureEvents(Event.CLICK); |
window.onclick=WW_processclick; } |
else { // Microsoft |
document.onclick=WW_processclick; } |
WW_pointerlayer = WW_getlayer('WWpointerblock'); // Pointer |
WW_pointerlayer.onmouseover = WW_overpointerblock; // Mouse Over |
WW_pointerlayer.onmouseout = WW_offpointerblock; // Mouse Out |
WW_pointermessageobject = WW_getlayer('WWpointermessage'); |
if(!WW_Netscape4 ) { // Microsoft set layer width |
WW_pointermessageobject.style.width =200; |
WW_pointerlayer.style.width=64; } |
return; |
} // End WW_pageisloaded() |
Capture ALL Click events and set handler |
Set event handlers for mouse events captured |
in conventional way |
function WW_processclick(e) { // Process Mouse Click |
var clickX = WW_eventx(e); // Extract Mouse Click Position |
var clickY = WW_eventy(e); |
// Position Top right of pointer at mouse click |
var width = WW_getlayerwidth(WW_pointerlayer); |
WW_layershiftto(WW_pointerlayer,clickX-width,clickY); |
WW_layershow(WW_pointerlayer); // Make pointer visible |
WW_layertotop(WW_pointerlayer); // set zindex=1000 |
WW_offpointerblock(); // remove stray mouseover messages |
window.status = 'click'; // flag action |
// true implies that you continue conventional processing i.e. |
return true; // that clicks on links are recognized |
} // End WW_processclick(e) |
In Netscape, the event is passed as an argument to the handler as in WW_processclick(e) |
While in Microsoft IE, event properties are stored in a single window property window.event |
So in WW_eventx(e), the argument is ignored in IE |
function WW_eventx(e) { // return x value of event |
if(WW_Netscape4 ) { |
return e.pageX; } // Netscape |
else { return window.event.clientX; } // Microsoft |
} // End WW_eventx(e) |
Also there is meant to be a different event handling model in browsers
|
var pointerheight = WW_getlayerheight(WW_pointerlayer); |
var localy = WW_getlayertop(WW_pointerlayer) + pointerheight; |
var localx = WW_getlayerleft(WW_pointerlayer); |
var messageheight = WW_getlayerheight(WW_pointermessageobject); |
var messagewidth = WW_getlayerwidth(WW_pointermessageobject); |
var windowwidth = WW_getwindowwidth(); |
var windowheight = WW_getwindowheight(); |
if( localx + messagewidth > windowwidth) |
localx = windowwidth - messagewidth; |
if( localy + messageheight > windowheight) |
localy = WW_getlayertop(WW_pointerlayer) - messageheight; |
This code, uses sizes of window, pointer and mouse over message to position latter so it always visible
|
Window Width and Height |
Current DOM and implementations are incomplete and inconsistent but illustrate the basic ideas
|
Can expect to be of growing importance and can effectively get started today
|
A wysiwyg HTML editor called NetObjects Fusion generates dynamic web pages in "Everywhere HTML" |
By using a combination of HTML, CSS-positioning and JavaScript, pages written in Everywhere HTML work properly on both Internet Explorer 4.0 and Communicator 4.0 (or so it is claimed) |