1. Roberto Ierusalimschy PUC-Rio, Brazil
Lua and the Web
Roberto Ierusalimschy
PUC-Rio, Brazil
PUC-Rio is the Catholic University of Rio de Janeiro. Our Computer Science Department ("Departamento de Informatica") is considered the best one in Brazil.
I am an associate professor there.
Lua is the work of Waldemar Celes, Luiz H. Figueiredo and me, in no particular order.
CGILua is the work of Renato Borges, Anna Hester and me; Anna and Renato are graduate students of mine...
Lua and the Web

2. What is Lua? Yet Another Scripting Language an “extension” language
implemented as a library in ANSI C
Host
Program
Lua
Interpreter
-- a Lua script
color = RED
b = button {
label = ‘OK’,
x = 10,
y = 20}
Lua lives in a niche close to Tcl, Perl and Python. From its kind of use, Tcl is the closer; both Tcl and Lua were created as an embedded language (in opposition to Perl and Python). Both are small and "slim".
Lua seems to be more appropriate than Tcl for real programs, and then gets as an alternative to Python and Perl. (In fact, I don't know whether Python is really a scripting language; it seems a very nice language, but a little "heavy" for real "quick-and-dirty" programming.) Lua is much smaller than Perl, on the other hand it has a much smaller library. I would say Perl is more appropriate for systems administration (standard Lua has no Posix facilities, only ANSI C), but is really for hackers.
Lua and the Web

3. Why Lua? Simple and flexible Small Efficient Portable
“Simple things simple, complex things possible”
Small
Efficient
Portable
Whole library written in ANSI C, compiles the same source code in all platforms
Typical uses: MS-DOS, Windows (3.1, 95, NT), Unix (Linux, Solaris, IRIX, AIX, ULTRIX), Next, OS/2, Mac
Lua is smaller, faster and more portable than Tcl, Perl and Python. Simplicity and flexibility are more arguable qualities...
Lua and the Web

4. What is CGILua? a Web development tool for creating dynamic sites
Supports both templates and scripts
templates can embed scripts
scripts can “call” templates
based on Lua for
its scripts
expanding templates
its own configuration
Lua and the Web

5. Why CGILua? Small Simple Portable
whole distribution (source+binaries) fits in one floppy disk
Simple
smooth learning curve
Portable
runs on Unix and Windows 95-NT
scripts run on any platform without changes
Easily extended with dynamic libraries written in Lua and C
Lua and the Web

6. Where is Lua? TeCGraf PUC-Rio Lua’s birthplace
partnership between PUC-Rio and Petrobras (the Brazilian Oil Company)
dozens of products developed with Lua, since 1994
PUC-Rio
many academic projects
used by hundreds of programmers
Intranet developed with CGILua
It is quite difficult to keep track of Lua. We keep a Web page of projects that use Lua, but most people do not take the time to contribute (most entries are written by us, when we learn about a new project).
Even at home (at PUC-Rio) sometimes we get surprised to learn that a new group is using Lua. Inside our Department, at least eight other Professors (from independent research groups) use Lua in their projects or courses. This is quite a mark, considering the natural rivalry between these groups.
Lua and the Web

7. Where is Lua? Inside Brazil Outside Brazil
Petrobras, the Brazilian Oil Company
Embratel (the main telecommunication company in Brazil)
many other companies
Outside Brazil
Lua is used in hundreds of projects, both commercial and academic
CGILua still in restricted use
until recently all documentation was in Portuguese
CGILua is also spread, but mainly in Brazil. CGILua has got a commercial impact much bigger than Lua, and that created some pressure for documentation in Portuguese. Only recently we found the time to translate it to English...
Lua and the Web

8. How is Lua? Pascal-like Syntax.
function fat (n)
if n == 0 then
return 1
else
return n*fat(n-1)
end
Pascal-like Syntax.
Interpreter executes sequence of statements.
function definitions are also statements (see later)
Six types:
numbers, tables, functions, strings, userdata, nil
Lua and the Web

9. Tables Implement associative arrays:
any value (including functions and other tables) can be used both for indices and values
t = {} creates an empty table
t[1] = "hello"
t.x = print t.x is sugar for t[‘x’]
t.x(t[1]) prints ‘hello’
t.next = t circular list
The first line creates an empty table, and stores a reference to it in “t”. Then the string “hello” is associated with index 1, and the function print is associated with index “x”.
Lua and the Web

10. Constructors Expressions to create and initialize tables Record style
point={x=10,y=20}
print(point.y) --> 20
List style
days={"Sun","Mon","Tue","Wed","Thu","Fri","Sat"}
print(days[3]) --> Tue
Mixed style
points={{x=0,y=0}, point; n=2}
print(points[points.n].y) --> 20
Constructors were inspired by some “declarative” languages, such as BibTex and IDL (a language for describing interfaces in Motif).
Note in the last example a use of nested constructors: because a constructor is an expression, it can be used wherever a value is expected.
Lua and the Web

11. Constructors Data description uses: calls function “article” article{
author="F.P.Brooks",
title="The Mythical Man-Month",
year=1975, }
news = {
{text = "New version 2.0", date = "21/05/1997"},
{text = "New example", date = "21/05/1997"},
{text = "New version: 2.1",date = "17/06/1997"}, }
The syntax “foo{...}” is only syntactic sugar for “foo({...})”, that is, a table is created by the constructor and then passed as argument to the function “foo”. Typically, such a function can check if the fields are correct, supply default values to some fields, and register the table in same global place.
Many people write those kind of declarations in an application (a typical example is for describing a GU interface), and don’t even know they are “programming” in Lua...
Lua and the Web

12. Tables x Objects Tables are dynamically created objects.
in the sense of Hoare
list = {value=v, next=list}
list
old list
...
This is a big difference between tables in Lua and associative arrays in other languages, such as AWK and Tcl. Tables in Lua are “objects”, in the sense of Hoare, that is, dynamically allocated “things” manipulated through pointers to them.
Tables in Lua can directly represent dynamic structures such as trees and graphs, even cyclic structures.
Moreover, tables allow an Object-Oriented style of programming in Lua; see later.
value - v
next -
Lua and the Web

13. Functions in Lua First class values Example: cloning a table t
function inc (x)
return x+1
end
inc = function (x)
sugar
Example: cloning a table t
clone = {}
foreach(t, function (i,e)
clone[i]=e
end)
In the last example, “foreach” is a predefined function that applies a given function over all elements of a given table. For each element, the function is called with two arguments, the index and the value.
Functions as first class values is a key mechanism in Lua; albeit few people do functional programming in Lua, this facility is used for Object-oriented programming in Lua, for redefining functions, and many other goods things. We will see some of them later.
Lua and the Web

14. Upvalues Mechanism to allow functions to access non-local variables
An upvalue is a variable expression whose value is computed when the enclosing function is instantiated (and not when the function is executed)
function add (x)
return function (y)
return y+%x
end
add1 = add(1)
print(add1(10)) --> 11
Upvalues give to Lua the full power of Lambda-Calculus. For programmers that do functional programming, this is a must.
Like functions as first-class values, this is the kind of mechanism that most people do not understand how useful it can be. Nevertheless, even those people take great advantage of upvalues. The next slides show a somewhat unexpected use of upvalues that plays a key role in CGILua architecture.
upvalue
Lua and the Web

15. Example: Security User scripts need a “secure” Lua environment
Security can be set in Lua itself, through redefinition of “dangerous” functions
functions are first-class values!!
With upvalues, the new function still can use the old, unsecure, version to implement its core functionality
Because the old version is kept in the closure of the new version, it is no longer accessible by the script
Again, this follows a general pattern in Lua/CGILua design: to provide metamechanisms. Instead of providing specific support for secure environments, Lua provides mechanisms that allow a programmer to build a secure environment.
As a result, we have more flexibility; each site can have its own security policies, and even different security levels for different users.
Lua and the Web

16. Example: Security -- redefines "openfile", to restrict files that
-- can be open by a script
openfile = function (filename)
if is_ok(filename) then
%openfile(filename)
else
error("cannot open "..filename)
end
-- at this point, only the new "openfile" is
-- visible, but the old function is still
-- available inside the new to do the real job
The upvalue “%openfile” is evaluated when this function is created, before the assignment. So, it gets the value of the old “openfile” function, the original one with the raw functionality.
Lua and the Web

17. Objects First class functions + tables = almost OO.
tables can have functions as field values (methods)
Syntactic sugar for defining and calling methods
handles hidden parameter self
a.foo(a,x)
a:foo(x)
a.foo = function (self,x)
...
end
function a:foo (x)
sugar
This is only to illustrate how OO can be done in Lua. There is much more to say about that, but CGILua does not use those facilities, so this is not our focus here.
Specifically, in the above scheme we miss inheritance. Lua does not provide inheritance, but it is very easy to implement delegation. With delegation, we can do a “prototype-base” OO programming.
Lua and the Web

18. Strings No size limits, good performance for long strings
common practice to read a whole text file in a single string before processing
Strings can store arbitrary binary data
not ‘\0’ terminated
Usual pattern matching facilities, implemented through a standard library
Pattern substitution can be called with a function to compute the replacement string
Lua and the Web

19. Example: Decoding a URL encoding string
This function is used by CGILua to decode a URL encoding string:
“lua%3Dis+great”  “lua=is great”
function unescape (str)
str = gsub(str, "+", " ")
return gsub(str, "%%(%x%x)", function (x)
return strchar(tonumber(x, 16))
end)
end
The first “gsub” changes all ‘+’ into white spaces.
The second one changes all patterns ‘%XX’ (where X is an hexadecimal digit) to their corresponding characters. The ‘%%’ matches the ‘%’ (‘%’ is the escape character for pattern matching in Lua, so we need to unescape it...). The ‘%x’ matches an hexadecimal digit. The ‘(%x%x)’ matches two hexa-digits, and the parentheses “capture” the result, which is then passed as argument to the given function.
That anonymous function is the called for each ‘%XX’ in the string, with the ‘XX’ as its only argument. “tonumber” converts the string ‘XX’ to a number (16 is the base), and “strchar” converts that number to the corresponding ASCII character.
Lua and the Web

20. Example: Decoding URL data
This function collects all pairs <key,value> from a submission into the table cgi:
function decode (string)
cgi={}
gsub(string, "([^&=]*)=([^&=]*)&?",
function (key, value)
key=unescape(key)
value=unescape(value)
cgi[key]=value
end)
end
The pattern matches a repetition of any characters different from ‘&’ and ‘=‘, followed by ‘=‘, again followed by a repetition of characters different from ‘&’ and ‘=‘, and finally followed by an optional ‘&’. The parts in parentheses are captured as arguments to the inline function; so a string like “a=boo&cat=dog” will call the function first with arguments “a” and “boot” and then with “cat” and “dog”. Those pairs will be stored in the table ‘cgi’, that in the end will have as its value {a=“boo”, cat=“dog”}.
All this work is automatically done by CGILua. CGILua programmers do not need to know this code. Any script or template receives the data already parsed into the table ‘cgi’.
Lua and the Web

21. CGILua Pages a page can be created by a script:
write("Content-type: text/html\n\n")
write("<html>")
write("<head><title>Simple page</title></head>")
write("<body>")
write("<h1>Today's date is: ", date(), "</h1>")
write("</body>")
write("</html>")
Lua and the Web

22. or it can be a template: <html>
<head><title>Simple page</title></head>
<body>
<h1>Today's date is: $|date()|$ </h1>
</body>
</html>
Lua
expression
Lua and the Web

23. Example: echoing
the following script can be used for debugging, to show all data posted by a form:
write("Content-type: text/html\n\n")
write("<html>")
write("<head><title>Your data</title></head>")
write("<body><h1>Your data</h1>")
write("<table border=1 width=100%>")
foreach(cgi, function(key,value)
write("<tr><td>", key, "</td>")
write("<td>", value, "</td></tr>")
end)
write("</table></body></html>")
As we have seen, “foreach” iterates over the elements of a table, and “cgi” is a table that CGILua creates with the form data already parsed.
Lua and the Web

24. Example: echoing The same page can be generated by a template:
<html>
<head><title>Your data</title></head>
<body><h1>Your data</h1>
<table border=1 width=100%>
<!--$$ LOOP start="key,value=next(cgi,nil)",
test="key",
action="key,value=next(cgi,key)" $$-->
<tr><td> $|key|$ </td>
<td> $|value|$ </td></tr>
<!--$$ ENDLOOP $$-->
</table></body></html>
This is a more complex example, mainly because it uses some Lua facilities that we have not discussed before (as multiple assignment). It also uses the control facilities that CGILua offers for templates. The strings “start”, “test” and “action” in the LOOP tag are fragments of Lua code to control de loop. “next” is a predefined function in Lua that iterates over the elements of a table, one by one (each time it is called, it returns a ‘next’ element).
There are other slides showing the LOOP construct. This one is here more for completeness (that is, to show that the task performed in the previous slide can be done by templates, too).
Lua and the Web

25. Template Preprocessing
Three kinds of marks:
expressions
statements
control fields: loops and conditionals
All marks has a sensible appearance when not preprocessed
statements and control fields handled as comments
expressions appear literally (place-holder)
Templates can be edited like a static page with conventional tools
Lua and the Web

26. Template before preprocessing
Template Example
Template before preprocessing
<h1>Club member list</h1>
<table border=1 width=100%>
<tr align=center>
<td><strong>First Name</strong></td>
<td><strong>Last Name</strong></td>
</tr>
<!--$$ LOOP start=‘i=1’,
test=‘i<=field.n’,
action=‘i=i+1’ $$->
<tr><td>$| m[i].firstname |$</td>
<td>$| m[i].lastname |$</td>
<!--$$ ENDLOOP $$-->
</table>
Lua and the Web

27. Template after preprocessing
Template Example
Template after preprocessing
Now, suppose table m defined as
m = {
{firstname='George', lastname='Harrison'},
{firstname='John', lastname='Lennon'},
{firstname='Paul', lastname='McCartney'},
{firstname='Ringo', lastname='Starr'} }
Lua and the Web

28. Extensions
CGILua can include libraries written both in Lua and in C/C++
e.g. database access, cryptography
Libraries can be loaded dynamically
no need of recompilations/relinks
Loading function can be erased after configuration
enhance security
this is a test. I do not believe this will work, but I will try
nevertheless. Well, I guess this is enough.
Lua and the Web

29. Conclusions Lua and CGILua are smart choices Small and simple Flexible
Portable
Lua and the Web