Roberto Ierusalimschy PUC-Rio, Brazil Lua and the Web Roberto Ierusalimschy PUC-Rio, Brazil PUC-Rio is the Catholic University of Rio de Janeiro. Our Computer Science Department ("Departamento de Informatica") is considered the best one in Brazil. I am an associate professor there. Lua is the work of Waldemar Celes, Luiz H. Figueiredo and me, in no particular order. CGILua is the work of Renato Borges, Anna Hester and me; Anna and Renato are graduate students of mine... Lua and the Web

What is Lua? Yet Another Scripting Language an “extension” language implemented as a library in ANSI C Host Program Lua Interpreter -- a Lua script color = RED b = button { label = ‘OK’, x = 10, y = 20} Lua lives in a niche close to Tcl, Perl and Python. From its kind of use, Tcl is the closer; both Tcl and Lua were created as an embedded language (in opposition to Perl and Python). Both are small and "slim". Lua seems to be more appropriate than Tcl for real programs, and then gets as an alternative to Python and Perl. (In fact, I don't know whether Python is really a scripting language; it seems a very nice language, but a little "heavy" for real "quick-and-dirty" programming.) Lua is much smaller than Perl, on the other hand it has a much smaller library. I would say Perl is more appropriate for systems administration (standard Lua has no Posix facilities, only ANSI C), but is really for hackers. Lua and the Web

Why Lua? Simple and flexible Small Efficient Portable “Simple things simple, complex things possible” Small Efficient Portable Whole library written in ANSI C, compiles the same source code in all platforms Typical uses: MS-DOS, Windows (3.1, 95, NT), Unix (Linux, Solaris, IRIX, AIX, ULTRIX), Next, OS/2, Mac Lua is smaller, faster and more portable than Tcl, Perl and Python. Simplicity and flexibility are more arguable qualities... Lua and the Web

What is CGILua? a Web development tool for creating dynamic sites Supports both templates and scripts templates can embed scripts scripts can “call” templates based on Lua for its scripts expanding templates its own configuration Lua and the Web

Why CGILua? Small Simple Portable whole distribution (source+binaries) fits in one floppy disk Simple smooth learning curve Portable runs on Unix and Windows 95-NT scripts run on any platform without changes Easily extended with dynamic libraries written in Lua and C Lua and the Web

Where is Lua? TeCGraf PUC-Rio Lua’s birthplace partnership between PUC-Rio and Petrobras (the Brazilian Oil Company) dozens of products developed with Lua, since 1994 PUC-Rio many academic projects used by hundreds of programmers Intranet developed with CGILua It is quite difficult to keep track of Lua. We keep a Web page of projects that use Lua, but most people do not take the time to contribute (most entries are written by us, when we learn about a new project). Even at home (at PUC-Rio) sometimes we get surprised to learn that a new group is using Lua. Inside our Department, at least eight other Professors (from independent research groups) use Lua in their projects or courses. This is quite a mark, considering the natural rivalry between these groups. Lua and the Web

Where is Lua? Inside Brazil Outside Brazil Petrobras, the Brazilian Oil Company Embratel (the main telecommunication company in Brazil) many other companies Outside Brazil Lua is used in hundreds of projects, both commercial and academic CGILua still in restricted use until recently all documentation was in Portuguese CGILua is also spread, but mainly in Brazil. CGILua has got a commercial impact much bigger than Lua, and that created some pressure for documentation in Portuguese. Only recently we found the time to translate it to English... Lua and the Web

How is Lua? Pascal-like Syntax. function fat (n) if n == 0 then return 1 else return n*fat(n-1) end Pascal-like Syntax. Interpreter executes sequence of statements. function definitions are also statements (see later) Six types: numbers, tables, functions, strings, userdata, nil Lua and the Web

Tables Implement associative arrays: any value (including functions and other tables) can be used both for indices and values t = {} -- creates an empty table t[1] = "hello" t.x = print -- t.x is sugar for t[‘x’] t.x(t[1]) -- prints ‘hello’ t.next = t -- circular list The first line creates an empty table, and stores a reference to it in “t”. Then the string “hello” is associated with index 1, and the function print is associated with index “x”. Lua and the Web

Constructors Expressions to create and initialize tables Record style point={x=10,y=20} print(point.y) --> 20 List style days={"Sun","Mon","Tue","Wed","Thu","Fri","Sat"} print(days[3]) --> Tue Mixed style points={{x=0,y=0}, point; n=2} print(points[points.n].y) --> 20 Constructors were inspired by some “declarative” languages, such as BibTex and IDL (a language for describing interfaces in Motif). Note in the last example a use of nested constructors: because a constructor is an expression, it can be used wherever a value is expected. Lua and the Web

Constructors Data description uses: calls function “article” article{ author="F.P.Brooks", title="The Mythical Man-Month", year=1975, } news = { {text = "New version 2.0", date = "21/05/1997"}, {text = "New example", date = "21/05/1997"}, {text = "New version: 2.1",date = "17/06/1997"}, } The syntax “foo{...}” is only syntactic sugar for “foo({...})”, that is, a table is created by the constructor and then passed as argument to the function “foo”. Typically, such a function can check if the fields are correct, supply default values to some fields, and register the table in same global place. Many people write those kind of declarations in an application (a typical example is for describing a GU interface), and don’t even know they are “programming” in Lua... Lua and the Web

Tables x Objects Tables are dynamically created objects. in the sense of Hoare list = {value=v, next=list} list old list ... This is a big difference between tables in Lua and associative arrays in other languages, such as AWK and Tcl. Tables in Lua are “objects”, in the sense of Hoare, that is, dynamically allocated “things” manipulated through pointers to them. Tables in Lua can directly represent dynamic structures such as trees and graphs, even cyclic structures. Moreover, tables allow an Object-Oriented style of programming in Lua; see later. value - v next - Lua and the Web

Functions in Lua First class values Example: cloning a table t function inc (x) return x+1 end inc = function (x) sugar Example: cloning a table t clone = {} foreach(t, function (i,e) clone[i]=e end) In the last example, “foreach” is a predefined function that applies a given function over all elements of a given table. For each element, the function is called with two arguments, the index and the value. Functions as first class values is a key mechanism in Lua; albeit few people do functional programming in Lua, this facility is used for Object-oriented programming in Lua, for redefining functions, and many other goods things. We will see some of them later. Lua and the Web

Upvalues Mechanism to allow functions to access non-local variables An upvalue is a variable expression whose value is computed when the enclosing function is instantiated (and not when the function is executed) function add (x) return function (y) return y+%x end add1 = add(1) print(add1(10)) --> 11 Upvalues give to Lua the full power of Lambda-Calculus. For programmers that do functional programming, this is a must. Like functions as first-class values, this is the kind of mechanism that most people do not understand how useful it can be. Nevertheless, even those people take great advantage of upvalues. The next slides show a somewhat unexpected use of upvalues that plays a key role in CGILua architecture. upvalue Lua and the Web

Example: Security User scripts need a “secure” Lua environment Security can be set in Lua itself, through redefinition of “dangerous” functions functions are first-class values!! With upvalues, the new function still can use the old, unsecure, version to implement its core functionality Because the old version is kept in the closure of the new version, it is no longer accessible by the script Again, this follows a general pattern in Lua/CGILua design: to provide metamechanisms. Instead of providing specific support for secure environments, Lua provides mechanisms that allow a programmer to build a secure environment. As a result, we have more flexibility; each site can have its own security policies, and even different security levels for different users. Lua and the Web

Example: Security -- redefines "openfile", to restrict files that -- can be open by a script openfile = function (filename) if is_ok(filename) then %openfile(filename) else error("cannot open "..filename) end -- at this point, only the new "openfile" is -- visible, but the old function is still -- available inside the new to do the real job The upvalue “%openfile” is evaluated when this function is created, before the assignment. So, it gets the value of the old “openfile” function, the original one with the raw functionality. Lua and the Web

Objects First class functions + tables = almost OO. tables can have functions as field values (methods) Syntactic sugar for defining and calling methods handles hidden parameter self a.foo(a,x) a:foo(x) a.foo = function (self,x) ... end function a:foo (x) sugar This is only to illustrate how OO can be done in Lua. There is much more to say about that, but CGILua does not use those facilities, so this is not our focus here. Specifically, in the above scheme we miss inheritance. Lua does not provide inheritance, but it is very easy to implement delegation. With delegation, we can do a “prototype-base” OO programming. Lua and the Web

Strings No size limits, good performance for long strings common practice to read a whole text file in a single string before processing Strings can store arbitrary binary data not ‘\0’ terminated Usual pattern matching facilities, implemented through a standard library Pattern substitution can be called with a function to compute the replacement string Lua and the Web

Example: Decoding a URL encoding string This function is used by CGILua to decode a URL encoding string: “lua%3Dis+great”  “lua=is great” function unescape (str) str = gsub(str, "+", " ") return gsub(str, "%%(%x%x)", function (x) return strchar(tonumber(x, 16)) end) end The first “gsub” changes all ‘+’ into white spaces. The second one changes all patterns ‘%XX’ (where X is an hexadecimal digit) to their corresponding characters. The ‘%%’ matches the ‘%’ (‘%’ is the escape character for pattern matching in Lua, so we need to unescape it...). The ‘%x’ matches an hexadecimal digit. The ‘(%x%x)’ matches two hexa-digits, and the parentheses “capture” the result, which is then passed as argument to the given function. That anonymous function is the called for each ‘%XX’ in the string, with the ‘XX’ as its only argument. “tonumber” converts the string ‘XX’ to a number (16 is the base), and “strchar” converts that number to the corresponding ASCII character. Lua and the Web

Example: Decoding URL data This function collects all pairs <key,value> from a submission into the table cgi: function decode (string) cgi={} gsub(string, "([^&=]*)=([^&=]*)&?", function (key, value) key=unescape(key) value=unescape(value) cgi[key]=value end) end The pattern matches a repetition of any characters different from ‘&’ and ‘=‘, followed by ‘=‘, again followed by a repetition of characters different from ‘&’ and ‘=‘, and finally followed by an optional ‘&’. The parts in parentheses are captured as arguments to the inline function; so a string like “a=boo&cat=dog” will call the function first with arguments “a” and “boot” and then with “cat” and “dog”. Those pairs will be stored in the table ‘cgi’, that in the end will have as its value {a=“boo”, cat=“dog”}. All this work is automatically done by CGILua. CGILua programmers do not need to know this code. Any script or template receives the data already parsed into the table ‘cgi’. Lua and the Web

CGILua Pages a page can be created by a script: write("Content-type: text/html\n\n") write("<html>") write("<head><title>Simple page</title></head>") write("<body>") write("<h1>Today's date is: ", date(), "</h1>") write("</body>") write("</html>") Lua and the Web

or it can be a template: <html> <head><title>Simple page</title></head> <body> <h1>Today's date is: $|date()|$ </h1> </body> </html> Lua expression Lua and the Web

Example: echoing the following script can be used for debugging, to show all data posted by a form: write("Content-type: text/html\n\n") write("<html>") write("<head><title>Your data</title></head>") write("<body><h1>Your data</h1>") write("<table border=1 width=100%>") foreach(cgi, function(key,value) write("<tr><td>", key, "</td>") write("<td>", value, "</td></tr>") end) write("</table></body></html>") As we have seen, “foreach” iterates over the elements of a table, and “cgi” is a table that CGILua creates with the form data already parsed. Lua and the Web

Example: echoing The same page can be generated by a template: <html> <head><title>Your data</title></head> <body><h1>Your data</h1> <table border=1 width=100%> <!--$$ LOOP start="key,value=next(cgi,nil)", test="key", action="key,value=next(cgi,key)" $$--> <tr><td> $|key|$ </td> <td> $|value|$ </td></tr> <!--$$ ENDLOOP $$--> </table></body></html> This is a more complex example, mainly because it uses some Lua facilities that we have not discussed before (as multiple assignment). It also uses the control facilities that CGILua offers for templates. The strings “start”, “test” and “action” in the LOOP tag are fragments of Lua code to control de loop. “next” is a predefined function in Lua that iterates over the elements of a table, one by one (each time it is called, it returns a ‘next’ element). There are other slides showing the LOOP construct. This one is here more for completeness (that is, to show that the task performed in the previous slide can be done by templates, too). Lua and the Web

Template Preprocessing Three kinds of marks: expressions statements control fields: loops and conditionals All marks has a sensible appearance when not preprocessed statements and control fields handled as comments expressions appear literally (place-holder) Templates can be edited like a static page with conventional tools Lua and the Web

Template before preprocessing Template Example Template before preprocessing <h1>Club member list</h1> <table border=1 width=100%> <tr align=center> <td><strong>First Name</strong></td> <td><strong>Last Name</strong></td> </tr> <!--$$ LOOP start=‘i=1’, test=‘i<=field.n’, action=‘i=i+1’ $$-> <tr><td>$| m[i].firstname |$</td> <td>$| m[i].lastname |$</td> <!--$$ ENDLOOP $$--> </table> Lua and the Web

Template after preprocessing Template Example Template after preprocessing Now, suppose table m defined as m = { {firstname='George', lastname='Harrison'}, {firstname='John', lastname='Lennon'}, {firstname='Paul', lastname='McCartney'}, {firstname='Ringo', lastname='Starr'} } Lua and the Web

Extensions CGILua can include libraries written both in Lua and in C/C++ e.g. database access, cryptography Libraries can be loaded dynamically no need of recompilations/relinks Loading function can be erased after configuration enhance security this is a test. I do not believe this will work, but I will try nevertheless. Well, I guess this is enough. Lua and the Web

Conclusions Lua and CGILua are smart choices Small and simple Flexible Portable Lua and the Web