File upload and revamped documentation.

Lib/cgi.py

@@ -1,65 +1,369 @@
 #!/usr/local/bin/python
 
-# XXX TODO
+"""Support module for CGI (Common Gateway Interface) scripts.
-# - proper doc strings instead of this rambling dialogue style
-# - more utilities, e.g.
-#   - print_header(type="test/html", blankline=1) -- print MIME header
-#   - utility to format a nice error message in HTML
-#   - utility to format a Location: ... response, including HTML
-#   - utility to catch errors and display traceback
 
-#
+This module defines a number of utilities for use by CGI scripts written in 
-# A class for wrapping the WWW Forms Common Gateway Interface (CGI) 
+Python.
-# Michael McLay, NIST  mclay@eeel.nist.gov  6/14/94
-# 
-# modified by Steve Majewski <sdm7g@Virginia.EDU> 12/5/94 
-#
-# now maintained as part of the Python distribution
-
-# Several classes to parse the name/value pairs that are passed to 
-# a server's CGI by GET, POST or PUT methods by a WWW FORM. This 
-# module is based on Mike McLay's original cgi.py after discussing
-# changes with him and others on the comp.lang.python newsgroup, and
-# at the NIST Python workshop. 
-#
-# The rationale for changes was:
-#    The original FormContent class was almost, but not quite like
-#    a dictionary object. Besides adding some extra access methods,
-#    it had a values() method with different arguments and semantics
-#    from the standard values() method of a mapping object. Also, 
-#    it provided several different access methods that may be necessary
-#    or useful, but made it a little more confusing to figure out how
-#    to use. Also, we wanted to make the most typical cases the simplest
-#    and most convenient access methods. ( Most form fields just return
-#    a single value, and in practice, a lot of code was just assuming
-#    a single value and ignoring all others. On the other hand, the 
-#    protocol allows multiple values to be returned. 
-#
-#  The new base class (FormContentDict) is just like a dictionary.
-#  In fact, if you just want a dictionary, all of the stuff that was
-#  in __init__ has been extracted into a cgi.parse() function that will
-#  return the "raw" dictionary, but having a class allows you to customize 
-#  it further. 
-#   Mike McLay's original FormContent class is reimplemented as a 
-#  subclass of FormContentDict.
-#   There are two additional sub-classes, but I'm not yet too sure 
-#  whether they are what I want. 
-# 
-
-import string,regsub,sys,os,urllib
-# since os.environ may often be used in cgi code, we name it in this module.
-from os import environ
 
 
-def parse():
+Introduction
-	"""Parse the query passed in the environment or on stdin"""
+------------
+
+A CGI script is invoked by an HTTP server, usually to process user input 
+submitted through an HTML <FORM> or <ISINPUT> element.
+
+Most often, CGI scripts live in the server's special cgi-bin directory.  
+The HTTP server places all sorts of information about the request (such as 
+the client's hostname, the requested URL, the query string, and lots of 
+other goodies) in the script's shell environment, executes the script, and 
+sends the script's output back to the client.
+
+The script's input is connected to the client too, and sometimes the form 
+data is read this way; at other times the form data is passed via the 
+"query string" part of the URL.  This module (cgi.py) is intended to take 
+care of the different cases and provide a simpler interface to the Python 
+script.  It also provides a number of utilities that help in debugging 
+scripts, and the latest addition is support for file uploads from a form
+(if your browser supports it -- Grail 0.3 and Netscape 2.0 do).
+
+The output of a CGI script should consist of two sections, separated by a 
+blank line.  The first section contains a number of headers, telling the 
+client what kind of data is following.  Python code to generate a minimal 
+header section looks like this:
+
+	print "Content-type: text/html"		# HTML is following
+	print					# blank line, end of headers
+
+The second section is usually HTML, which allows the client software to 
+display nicely formatted text with header, in-line images, etc.  Here's 
+Python code that prints a simple piece of HTML:
+
+	print "<TITLE>CGI script output</TITLE>"
+	print "<H1>This is my first CGI script</H1>"
+	print "Hello, world!"
+
+(It may not be fully legal HTML according to the letter of the standard, 
+but any browser will understand it.)
+
+
+Using the cgi module
+--------------------
+
+Begin by writing "import cgi".  Don't use "from cgi import *" -- the module 
+defines all sorts of names for its own use that you don't want in your 
+namespace.
+
+If you have a standard form, it's best to use the SvFormContentDict class.  
+Instantiate the SvFormContentDict class exactly once: it consumes any input 
+on standard input, which can't be wound back (it's a network connection, 
+not a disk file).
+
+The SvFormContentDict instance can be accessed as if it were a Python 
+dictionary.  For instance, the following code checks that the fields 
+"name" and "addr" are both set to a non-empty string:
+
+	form = SvFormContentDict()
+	form_ok = 0
+	if form.has_key("name") and form.has_key("addr"):
+		if form["name"] != "" and form["addr"] != "":
+			form_ok = 1
+	if not form_ok:
+		print "<H1>Error</H1>"
+		print "Please fill in the name and addr fields."
+		return
+	...actual form processing here...
+
+If you have an input item of type "file" in your form and the client 
+supports file uploads, the value for that field, if present in the form, 
+is not a string but a tuple of (filename, content-type, data).
+
+
+Overview of classes
+-------------------
+
+SvFormContentDict: single value form content as dictionary; described 
+above.
+
+FormContentDict: multiple value form content as dictionary (the form items 
+are lists of values).  Useful if your form contains multiple fields with 
+the same name.
+
+Other classes (FormContent, InterpFormContentDict) are present for 
+backwards compatibility only.
+
+
+Overview of functions
+---------------------
+
+These are useful if you want more control, or if you want to employ some 
+of the algorithms implemented in this module in other circumstances.
+
+parse(): parse a form into a Python dictionary.
+
+parse_qs(qs): parse a query string.
+
+parse_multipart(...): parse input of type multipart/form-data (for file 
+uploads).
+
+parse_header(string): parse a header like Content-type into a main value 
+and a dictionary of parameters.
+
+test(): complete test program.
+
+print_environ(): format the shell environment in HTML.
+
+print_form(form): format a form in HTML.
+
+print_environ_usage(): print a list of useful environment variables in HTML.
+
+escape(): convert the characters "&", "<" and ">" to HTML-safe sequences.
+
+
+Caring about security
+---------------------
+
+There's one important rule: if you invoke an external program (e.g.  via 
+the os.system() or os.popen() functions), make very sure you don't pass 
+arbitrary strings received from the client to the shell.  This is a 
+well-known security hole whereby clever hackers anywhere on the web can 
+exploit a gullible CGI script to invoke arbitrary shell commands.  Even 
+parts of the URL or field names cannot be trusted, since the request 
+doesn't have to come from your form!
+
+To be on the safe side, if you must pass a string gotten from a form to a 
+shell command, you should make sure the string contains only alphanumeric 
+characters, dashes, underscores, and periods.
+
+
+Installing your CGI script on a Unix system
+-------------------------------------------
+
+Read the documentation for your HTTP server and check with your local 
+system administrator to find the directory where CGI scripts should be 
+installed; usually this is in a directory cgi-bin in the server tree.
+
+Make sure that your script is readable and executable by "others"; the Unix 
+file mode should be 755 (use "chmod 755 filename").  Make sure that the 
+first line of the script contains "#!" starting in column 1 followed by the 
+pathname of the Python interpreter, for instance:
+
+	#!/usr/local/bin/python
+
+Make sure the Python interpreter exists and is executable by "others".  
+
+Make sure that any files your script needs to read or write are readable or 
+writable, respectively, by "others" -- their mode should be 644 for 
+readable and 666 for writable.  This is because, for security reasons, the 
+HTTP server executes your script as user "nobody", without any special 
+privileges.  It can only read (write, execute) files that everybody can 
+read (write, execute).  The current directory at execution time is also 
+different (it is usually the server's cgi-bin directory) and the set of 
+environment variables is also different from what you get at login.  in 
+particular, don't count on the shell's search path for executables ($PATH) 
+or the Python module search path ($PYTHONPATH) to be set to anything 
+interesting.
+
+If you need to load modules from a directory which is not on Python's 
+default module search path, you can change the path in your script, before 
+importing other modules, e.g.:
+
+	import sys
+	sys.path.insert(0, "/usr/home/joe/lib/python")
+	sys.path.insert(0, "/usr/local/lib/python")
+
+(This way, the directory inserted last will be searched first!)
+
+Instructions for non-Unix systems will vary; check your HTTP server's 
+documentation (it will usually have a section on CGI scripts).
+
+
+Testing your CGI script
+-----------------------
+
+Unfortunately, a CGI script will generally not run when you try it from the 
+command line, and a script that works perfectly from the command line may 
+fail mysteriously when run from the server.  There's one reason why you 
+should still test your script from the command line: if it contains a 
+syntax error, the python interpreter won't execute it at all, and the HTTP 
+server will most likely send a cryptic error to the client.
+
+Assuming your script has no syntax errors, yet it does not work, you have 
+no choice but to read the next section:
+
+
+Debugging CGI scripts
+---------------------
+
+First of all, check for trivial installation errors -- reading the section 
+above on installing your CGI script carefully can save you a lot of time.  
+If you wonder whether you have understood the installation procedure 
+correctly, try installing a copy of this module file (cgi.py) as a CGI 
+script.  When invoked as a script, the file will dump its environment and 
+the contents of the form in HTML form.  Give it the right mode etc, and 
+send it a request.  If it's installed in the standard cgi-bin directory, it 
+should be possible to send it a request by entering a URL into your browser 
+of the form:
+
+	http://yourhostname/cgi-bin/cgi.py?name=Joe+Blow&addr=At+Home
+
+If this gives an error of type 404, the server cannot find the script -- 
+perhaps you need to install it in a different directory.  If it gives 
+another error (e.g.  500), there's an installation problem that you should 
+fix before trying to go any further.  If you get a nicely formatted listing 
+of the environment and form content (in this example, the fields should be 
+listed as "addr" with value "At Home" and "name" with value "Joe Blow"), 
+the cgi.py script has been installed correctly.  If you follow the same 
+procedure for your own script, you should now be able to debug it.
+
+The next step could be to call the cgi module's test() function from your 
+script: replace its main code with the single statement
+
+	cgi.test()
+	
+This should produce the same results as those gotten from installing the 
+cgi.py file itself.
+
+When an ordinary Python script raises an unhandled exception (e.g. because 
+of a typo in a module name, a file that can't be opened, etc.), the Python 
+interpreter prints a nice traceback and exits.  While the Python 
+interpreter will still do this when your CGI script raises an exception, 
+most likely the traceback will end up in one of the HTTP server's log 
+file, or be discarded altogether.
+
+Fortunately, once you have managed to get your script to execute *some* 
+code, it is easy to catch exceptions and cause a traceback to be printed.
+The test() function below in this module is an example.  Here are the 
+rules:
+
+	1. Import the traceback module (before entering the try-except!)
+	
+	2. Make sure you finish printing the headers and the blank line early
+	
+	3. Assign sys.stderr to sys.stdout
+	
+	3. Wrap all remaining code in a try-except statement
+	
+	4. In the except clause, call traceback.print_exc()
+
+For example:
+
+	import sys
+	import traceback
+	print "Content-type: text/html"
+	print
+	sys.stderr = sys.stdout
+	try:
+		...your code here...
+	except:
+		print "\n\n<PRE>"
+		traceback.print_exc()
+
+Notes: The assignment to sys.stderr is needed because the traceback prints 
+to sys.stderr.  The print "\n\n<PRE>" statement is necessary to disable the 
+word wrapping in HTML.
+
+If you suspect that there may be a problem in importing the traceback 
+module, you can use an even more robust approach (which only uses built-in 
+modules):
+
+	import sys
+	sys.stderr = sys.stdout
+	print "Content-type: text/plain"
+	print
+	...your code here...
+
+This relies on the Python interpreter to print the traceback.  The content 
+type of the output is set to plain text, which disables all HTML 
+processing.  If your script works, the raw HTML will be displayed by your 
+client.  If it raises an exception, most likely after the first two lines 
+have been printed, a traceback will be displayed.  Because no HTML 
+interpretation is going on, the traceback will readable.
+
+Good luck!
+
+
+Common problems and solutions
+-----------------------------
+
+- Most HTTP servers buffer the output from CGI scripts until the script is 
+completed.  This means that it is not possible to display a progress report 
+on the client's display while the script is running.
+
+- Check the installation instructions above.
+
+- Check the HTTP server's log files.  ("tail -f logfile" in a separate 
+window may be useful!)
+
+- Always check a script for syntax errors first, by doing something like 
+"python script.py".
+
+- When using any of the debugging techniques, don't forget to add
+"import sys" to the top of the script.
+
+- When invoking external programs, make sure they can be found.  Usually, 
+this means using absolute path names -- $PATH is usually not set to a 
+very useful value in a CGI script.
+
+- When reading or writing external files, make sure they can be read or 
+written by every user on the system.
+
+- Don't try to give a CGI script a set-uid mode.  This doesn't work on most 
+systems, and is a security liability as well.
+
+
+History
+-------
+
+Michael McLay started this module.  Steve Majewski changed the interface to 
+SvFormContentDict and FormContentDict.  The multipart parsing was inspired 
+by code submitted by Andreas Paepcke.  Guido van Rossum rewrote, 
+reformatted and documented the module and is currently responsible for its 
+maintenance.
+
+"""
+
+
+# Imports
+# =======
+
+import string
+import regsub
+import sys
+import os
+import urllib
+
+
+# A shorthand for os.environ
+environ = os.environ
+
+
+# Parsing functions
+# =================
+
+def parse(fp=None):
+	"""Parse a query in the environment or from a file (default stdin)"""
+	if not fp:
+		fp = sys.stdin
+	if not environ.has_key('REQUEST_METHOD'):
+		environ['REQUEST_METHOD'] = 'GET'	# For testing
 	if environ['REQUEST_METHOD'] == 'POST':
-		qs = sys.stdin.read(string.atoi(environ['CONTENT_LENGTH']))
+		ctype, pdict = parse_header(environ['CONTENT_TYPE'])
+		if ctype == 'multipart/form-data':
+			return parse_multipart(fp, ctype, pdict)
+		elif ctype == 'application/x-www-form-urlencoded':
+			clength = string.atoi(environ['CONTENT_LENGTH'])
+			qs = fp.read(clength)
+		else:
+			qs = ''		# Bad content-type
 		environ['QUERY_STRING'] = qs
 	elif environ.has_key('QUERY_STRING'):
 		qs = environ['QUERY_STRING']
 	else:
-		environ['QUERY_STRING'] = qs = ''
+		if sys.argv[1:]:
+			qs = sys.argv[1]
+		else:
+			qs = ""
+		environ['QUERY_STRING'] = qs
 	return parse_qs(qs)
 
 
@@ -81,21 +385,129 @@ def parse_qs(qs):
 	return dict
 
 
+def parse_multipart(fp, ctype, pdict):
+	"""Parse multipart input.
 
-# The FormContent constructor creates a dictionary from the name/value pairs
+	Arguments:
-# passed through the CGI interface.
+	fp   : input file
+	ctype: content-type
+	pdict: dictionary containing other parameters of conten-type header
+
+	Returns a dictionary just like parse_qs() (keys are the field
+	names, each value is a list of values for that field) except
+	that if the value was an uploaded file, it is a tuple of the
+	form (filename, content-type, data).  Note that content-type
+	is the raw, unparsed contents of the content-type header.
+
+	XXX Should we parse further when the content-type is
+	multipart/*?
+
+	"""
+	import mimetools
+	if pdict.has_key('boundary'):
+		boundary = pdict['boundary']
+	else:
+		boundary = ""
+	nextpart = "--" + boundary
+	lastpart = "--" + boundary + "--"
+	partdict = {}
+	terminator = ""
+
+	while terminator != lastpart:
+		bytes = -1
+		data = None
+		if terminator:
+			# At start of next part.  Read headers first.
+			headers = mimetools.Message(fp)
+			clength = headers.getheader('content-length')
+			if clength:
+				try:
+					bytes = string.atoi(clength)
+				except string.atoi_error:
+					pass
+			if bytes > 0:
+				data = fp.read(bytes)
+			else:
+				data = ""
+		# Read lines until end of part.
+		lines = []
+		while 1:
+			line = fp.readline()
+			if not line:
+				terminator = lastpart # End outer loop
+				break
+			if line[:2] == "--":
+				terminator = string.strip(line)
+				if terminator in (nextpart, lastpart):
+					break
+			if line[-2:] == '\r\n':
+				line = line[:-2]
+			elif line[-1:] == '\n':
+				line = line[:-1]
+			lines.append(line)
+		# Done with part.
+		if data is None:
+			continue
+		if bytes < 0:
+			data = string.joinfields(lines, "\n")
+		line = headers['content-disposition']
+		if not line:
+			continue
+		key, params = parse_header(line)
+		if key != 'form-data':
+			continue
+		if params.has_key('name'):
+			name = params['name']
+		else:
+			continue
+		if params.has_key('filename'):
+			data = (params['filename'],
+				headers.getheader('content-type'), data)
+		if partdict.has_key(name):
+			partdict[name].append(data)
+		else:
+			partdict[name] = [data]
+
+	return partdict
 
 
-#
+def parse_header(line):
-#  form['key'] 
+	"""Parse a Content-type like header.
-#  form.__getitem__('key') 
+	
-#  form.has_key('key')
+	Return the main content-type and a dictionary of options.
-#  form.keys()
+	
-#  form.values()
+	"""
-#  form.items()
+	plist = map(string.strip, string.splitfields(line, ';'))
-#  form.dict
+	key = string.lower(plist[0])
+	del plist[0]
+	pdict = {}
+	for p in plist:
+		i = string.find(p, '=')
+		if i >= 0:
+			name = string.lower(string.strip(p[:i]))
+			value = string.strip(p[i+1:])
+			if len(value) >= 2 and value[0] == value[-1] == '"':
+				value = value[1:-1]
+			pdict[name] = value
+	return key, pdict
+
+
+# Main classes
+# ============
 
 class FormContentDict:
+	"""Basic (multiple values per field) form content as dictionary.
+	
+	form = FormContentDict()
+	
+	form[key] -> [value, value, ...]
+	form.has_key(key) -> Boolean
+	form.keys() -> [key, key, ...]
+	form.values() -> [[val, val, ...], [val, val, ...], ...]
+	form.items() ->  [(key, [val, val, ...]), (key, [val, val, ...]), ...]
+	form.dict == {key: [val, val, ...], ...}
+
+	"""
 	def __init__( self ):
 		self.dict = parse()
 		self.query_string = environ['QUERY_STRING']
@@ -113,45 +525,42 @@ def __len__( self ):
 		return len(self.dict)
 
 
-# This is the "strict" single-value expecting version. 
-# IF you only expect a single value for each field, then form[key]
-# will return that single value ( the [0]-th ), and raise an 
-# IndexError if that expectation is not true. 
-# IF you expect a field to have possible multiple values, than you
-# can use form.getlist( key ) to get all of the values. 
-# values() and items() are a compromise: they return single strings
-#  where there is a single value, and lists of strings otherwise. 
-
 class SvFormContentDict(FormContentDict):
-	def __getitem__( self, key ):
+	"""Strict single-value expecting form content as dictionary.
-		if len( self.dict[key] ) > 1 : 
+	
+	IF you only expect a single value for each field, then form[key]
+	will return that single value.
+	It will raise an IndexError if that expectation is not true. 
+	IF you expect a field to have possible multiple values, than you
+	can use form.getlist(key) to get all of the values. 
+	values() and items() are a compromise: they return single strings
+	where there is a single value, and lists of strings otherwise.
+	
+	"""
+	def __getitem__(self, key):
+		if len(self.dict[key]) > 1: 
 			raise IndexError, 'expecting a single value' 
 		return self.dict[key][0]
-	def getlist( self, key ):
+	def getlist(self, key):
 		return self.dict[key]
-	def values( self ):
+	def values(self):
 		lis = []
-		for each in self.dict.values() : 
+		for each in self.dict.values(): 
 			if len( each ) == 1 : 
-				lis.append( each[0] )
+				lis.append(each[0])
-			else: lis.append( each )
+			else: lis.append(each)
 		return lis
-	def items( self ):
+	def items(self):
 		lis = []
 		for key,value in self.dict.items():
 			if len(value) == 1 :
-				lis.append( (key,value[0]) )
+				lis.append((key, value[0]))
-			else:	lis.append( (key,value) )
+			else:	lis.append((key, value))
 		return lis
 
 
-# And this sub-class is similar to the above, but it will attempt to 
-# interpret numerical values. This is here as mostly as an example,
-# but I think the real way to handle typed-data from a form may be
-# to make an additional table driver parsing stage that has a table
-# of allowed input patterns and the output conversion types - it 
-# would signal type-errors on parse, not on access. 
 class InterpFormContentDict(SvFormContentDict):
+	"""This class is present for backwards compatibility only.""" 
 	def __getitem__( self, key ):
 		v = SvFormContentDict.__getitem__( self, key )
 		if v[0] in string.digits+'+-.' : 
@@ -178,28 +587,8 @@ def items( self ):
 		return lis
 
 
-# class FormContent parses the name/value pairs that are passed to a
-# server's CGI by GET, POST, or PUT methods by a WWW FORM. several 
-# specialized FormContent dictionary access methods have been added 
-# for convenience.
-
-# function                   return value
-#
-# form.keys()                     all keys in dictionary
-# form.has_key('key')             test keys existance
-# form[key]                       returns list associated with key
-# form.values('key')              key's list (same as form.[key])
-# form.indexed_value('key' index) nth element in key's value list
-# form.value(key)                 key's unstripped value 
-# form.length(key)                number of elements in key's list
-# form.stripped(key)              key's value with whitespace stripped
-# form.pars()                     full dictionary 
-
-
-
 class FormContent(FormContentDict):
-# This is the original FormContent semantics of values,
+	"""This class is present for backwards compatibility only.""" 
-# not the dictionary like semantics. 
 	def values(self,key):
 		if self.dict.has_key(key):return self.dict[key]
 		else: return None
@@ -221,14 +610,66 @@ def pars(self):
 		return self.dict
 
 
+# Test/debug code
+# ===============
 
+def test():
+	"""Robust test CGI script.
+	
+	Dump all information provided to the script in HTML form.
 
+	"""
+	import traceback
+	print "Content-type: text/html"
+	print
+	sys.stderr = sys.stdout
+	try:
+		print_environ()
+		print_form(FormContentDict())
+		print
+		print "<H3>Current Working Directory</H3>"
+		try:
+			pwd = os.getcwd()
+		except os.error, msg:
+			print "os.error:", escape(str(msg))
+		else:
+			print escape(pwd)
+		print
+	except:
+		print "\n\n<PRE>"	# Turn of word wrap
+		traceback.print_exc()
 
+def print_environ():
+	"""Dump the shell environment in HTML form."""
+	keys = environ.keys()
+	keys.sort()
+	print
+	print "<H3>Shell environment:</H3>"
+	print "<DL>"
+	for key in keys:
+		print "<DT>", escape(key), "<DD>", escape(environ[key])
+	print "</DL>" 
+	print
+
+def print_form(form):
+	"""Dump the contents of a form in HTML form."""
+	keys = form.keys()
+	keys.sort()
+	print
+	print "<H3>Form contents:</H3>"
+	print "<DL>"
+	for key in keys:
+		print "<DT>" + escape(key) + ":",
+		print "<i>" + escape(`type(form[key])`) + "</i>"
+		print "<DD>" + escape(`form[key]`)
+	print "</DL>"
+	print
 
 def print_environ_usage():
+	"""Print a list of environment variables used by the CGI protocol."""
 	print """
-<H3>These operating system environment variables could have been 
+<H3>These environment variables could have been set:</H3>
-set:</H3> <UL>
+<UL>
 <LI>AUTH_TYPE
 <LI>CONTENT_LENGTH
 <LI>CONTENT_TYPE
@@ -257,47 +698,21 @@ def print_environ_usage():
 </UL>
 """
 
-def print_environ():
-	skeys = environ.keys()
-	skeys.sort()
-	print '<h3> The following environment variables ' \
-	      'were set by the CGI script: </h3>'
-	print '<dl>'
-	for key in skeys:
-		print '<dt>', escape(key), '<dd>', escape(environ[key])
-	print '</dl>' 
 
-def print_form( form ):
+# Utilities
-	skeys = form.keys()
+# =========
-	skeys.sort()
-	print '<h3> The following name/value pairs ' \
-	      'were entered in the form: </h3>'
-	print '<dl>'
-	for key in skeys:
-		print '<dt>', escape(key), ':',
-		print '<i>', escape(`type(form[key])`), '</i>',
-		print '<dd>', escape(`form[key]`)
-	print '</dl>'
 
-def escape( s ):
+def escape(s):
-	s = regsub.gsub('&', '&amp;', s) # Must be done first
+	"""Replace special characters '&', '<' and '>' by SGML entities."""
-	s = regsub.gsub('<', '&lt;', s)
+	s = regsub.gsub("&", "&amp;", s)	# Must be done first!
-	s = regsub.gsub('>', '&gt;', s)
+	s = regsub.gsub("<", "&lt;", s)
+	s = regsub.gsub(">", "&gt;", s)
 	return s
 
-def test( what ):
-	label = escape(str(what))
-	print 'Content-type: text/html\n\n'
-	print '<HEADER>\n<TITLE>' + label + '</TITLE>\n</HEADER>\n'
-	print '<BODY>\n' 
-	print "<H1>" + label +"</H1>\n"
-	form = what()
-	print_form( form )
-	print_environ()
-	print_environ_usage() 
-	print '</body>'
 
-if __name__ == '__main__' : 
+# Invoke mainline
-	test_classes = ( FormContent, FormContentDict, SvFormContentDict, InterpFormContentDict )
+# ===============
-	test( test_classes[0] )	# by default, test compatibility with 
+
-				# old version, change index to test others.
+# Call test() when this file is run as a script (not imported as a module)
+if __name__ == '__main__': 
+	test()