Nothing yet.
"); icpp_sql_disconnect(db); ?> ``` `#include "../lib/app.c"` inside the first block is hoisted above `main()`, so a library file holds function definitions and nothing else runs at include time. A page cannot define its own functions: helpers go in `lib/`. --- ## 2. The language rules that break generated code These are the mistakes every model makes on its first ICPP page. Each was measured. 1. **Definition order is call order.** A function must be defined above any call that passes it arguments. There are no prototypes and no headers. In `lib/`, put the lowest-level helpers first. 2. **Declare with C types, or use `$name`.** `int db; char *s;` are ordinary locals. `$name` is an untyped local that needs no declaration and takes whatever it is assigned (number, string, handle). `$name` may only appear inside a function; in a page every block is inside `main()`, so it is fine there. In a standalone `.icpp` script, write a `main()` and put the code in it. 3. **Handles are `int`.** A database connection, a query result, a list, a map and a set are all `int` handles. A function that takes one declares `int`, not a pointer. Free what you open: `icpp_sql_free`, `icpp_list_free`, `icpp_map_free`, `icpp_sql_disconnect`. 4. **Never index or dereference a `char *`.** `s[0]`, `*s`, pointer arithmetic and `s == "x"` are wrong (the last compares addresses). Every string operation is a builtin: `icpp_strcmp`, `icpp_strlen`, `icpp_substr`, `icpp_strstr`, `icpp_trim`, `icpp_replace_all`, `icpp_split`, `icpp_re`. 5. **Build strings with `icpp_concat(...)`**, any number of arguments, numbers welcome: `icpp_concat("id=", id, "&n=", n)`. Do not join with `+` (measured: `$t + "cd"` did not join). Numbers to text: `icpp_concat("", n)`. Text to number: `icpp_atoi(s)` (stops at the first non-digit, "" gives 0). 6. **`iprint` appends a newline** after each call. Print whole tags in one call; never split a tag across two `iprint`s. `iprint` takes any number of arguments and no format string; `printf` exists for C-style formats. 7. **Regex escapes need a double backslash.** Inside an ICPP string, `\.` does not reach the regex engine; write `\\.` or use a class: `[.]`, `[?]`. `icpp_re(text, "^[0-9]+$")` returns the matched text or "". To test "is the whole string digits", compare `icpp_strlen(icpp_re(s, "^[0-9]+$"))` with `icpp_strlen(s)`. 8. **Escape everything from a visitor before printing it:** `icpp_html_escape(s)` for HTML, and see the SQL rule below. Every `iprint` of a database value or a form field goes through it. 9. **`continue`, `break`, `for`, `else if`, `?:`, `+=` all work.** Loop with `while` or `for`. Recursion works. 10. **A `$var` keeps its last type.** Do not assign a number and later a string to the same `$var`; use two names. --- ## 3. Requests, forms, cookies, redirects The page runs as a CGI program. The web server (iwebserver, the Runner, Apache with nouhata-cgi) sets the usual variables; read them with `icpp_getenv`: `REQUEST_METHOD`, `QUERY_STRING`, `HTTP_COOKIE`, `HTTP_USER_AGENT`, `REMOTE_ADDR`, `REQUEST_URI`, `HTTPS`. - **Form fields and query parameters** both arrive through `icpp_getparam("name")`, URL-decoded, "" when absent. A POST body in `application/x-www-form-urlencoded` is merged into the same place, so a field is read the same way whether the form was GET or POST. - **Was it a POST?** `icpp_strcmp(icpp_getenv("REQUEST_METHOD"), "POST") == 0`. - **Cap every field**: `icpp_substr(icpp_trim(icpp_getparam("title")), 0, 120)`. - **Headers** (Set-Cookie, Status, Location, Content-Type) cannot be printed: the server has already sent its own. They are appended, one per line, to the file named in the environment variable `ICPP_HEADERS_FILE` (`NOUHATA_HEADERS_FILE` on an Apache host set up like nouhata.com; set both to the same file when you write a server). The server emits that file before the body. Helper: ```c void app_header(char *line) { $path = icpp_getenv("ICPP_HEADERS_FILE"); if (icpp_strlen($path) == 0) return; $cur = icpp_file_read($path); icpp_file_write($path, icpp_concat($cur, line, "\r\n")); } void app_redirect(char *url) { app_header("Status: 303 See Other"); app_header(icpp_concat("Location: ", url)); iprint("Continue"); icpp_exit(0); } ``` - **After a POST that changed something, redirect** (303) to a GET page. Do the work, `icpp_sql_disconnect(db)`, then `app_redirect(...)`. Reloading never repeats the change. - **Cookies**: read `icpp_getenv("HTTP_COOKIE")` and find your name in it (`icpp_re(icpp_concat("; ", cookie), "; sid=[0-9a-f]+")`); set one with `Set-Cookie: sid=...; Path=/; HttpOnly; SameSite=Lax; Max-Age=2592000` through `app_header`. A session is a row in a `sessions` table keyed by a random id from `icpp_random_hex(16)`. - **CSRF**: keep a 32-hex token in the session row, print it as a hidden `csrf` field in every form, and refuse a POST whose `csrp` field differs. - **File uploads** (multipart) need the server's help; the Windows web suite and the Apache handler support them, the Runner does not yet. --- ## 4. The database (InternetSQL through `icpp_sql_*`) ```c int db; int r; db = icpp_sql_connect(icpp_getenv("ICPP_DB_HOME"), "shop"); // home directory, database name r = icpp_sql_query(db, "select thing_id, name from things where thing_id=5;"); if (icpp_sql_next(r)) iprint(icpp_trim(icpp_sql_get(r, "name"))); icpp_sql_free(r); icpp_sql_disconnect(db); ``` Rules, all measured on InternetSQL 1.25: 1. **Every value in SQL is either an int or a quoted string with `'` doubled.** There are no prepared statements. One helper does all the quoting: `char *q(char *v) { return icpp_concat("'", icpp_replace_all(v, "'", "''"), "'"); }` and every string reaches SQL through it. Numbers are `icpp_atoi`'d first. 2. **Name the columns in every INSERT**: `insert into things (thing_id, name, made_utc) values(...)`. A positional INSERT breaks silently the day a column is added. 3. **ORDER BY only on columns in the SELECT list.** Ordering by a column you did not select returns no rows and no error. 4. **One JOIN per SELECT.** Denormalise instead: keep a copy of the name you display (`shop_name` on the product row) rather than joining twice. 5. **No `count(*)`.** Count rows in a loop, or keep counters. 6. **Trim what you read**: `char` columns come back padded in some cases, so `icpp_trim(icpp_sql_get(r, "name"))` everywhere. 7. **Ids are yours to allocate.** No autoincrement: keep a `seq_counters` table (name, next_value), read, add one, write back, and take a lock around it (a lock is a file you create with `icpp_file_write` and remove; two requests are two processes). 8. **Timestamps are text** `"YYYY-MM-DDTHH:MM:SSZ"` in `char(24)`; they sort and compare as strings. Money is whole cents in `number(19)`; never floats. 9. **Column limits**: `char(n)` up to 240 on a wide table (the engine refuses more with "Can't add field"); use `text(8000)` for long text. 10. **A failed statement does not return 0.** Check `icpp_sql_status(db)` when a write may fail, and test writes with a following SELECT in your checks. 11. **The home must exist with a `db` folder inside** before the first connect; `create database shop;` then creates the database through a connection to `"default"`. Migrations are files `db/001.sql`, `db/002.sql`, ... each ending with a row in a `schema_versions` table, so a deployment applies only the new ones. 12. **Comments only between statements**, alone on their line (`-- ...`); a comment after a column or after `;` breaks the next statement. 13. **Every page opens its own connection and closes it.** A query on a closed connection returns nothing, silently, so compute redirect targets before `icpp_sql_disconnect`. --- ## 5. Page and library skeleton `lib/app.c`, in this order (lowest first): ```c char *q(char *v) { return icpp_concat("'", icpp_replace_all(v, "'", "''"), "'"); } char *h(char *v) { return icpp_html_escape(v); } char *field(char *name, int maxlen) { return icpp_substr(icpp_trim(icpp_getparam(name)), 0, maxlen); } int is_post(void) { if (icpp_strcmp(icpp_getenv("REQUEST_METHOD"), "POST") == 0) return 1; return 0; } void app_header(char *line) { ... as above ... } void app_redirect(char *url) { ... as above ... } int app_db(void) { return icpp_sql_connect(icpp_getenv("ICPP_DB_HOME"), "shop"); } void app_exec(int db, char *sql) { $r = icpp_sql_query(db, sql); icpp_sql_free($r); } char *app_one(int db, char *sql, char *col) { $v = ""; $r = icpp_sql_query(db, sql); if (icpp_sql_next($r)) $v = icpp_trim(icpp_sql_get($r, col)); icpp_sql_free($r); return $v; } void page_head(char *title) { iprint("