畢業(yè)設計外文文獻及其譯文學生姓名學號所在學院專業(yè)班級計算機科學與技術1201班2016年6月12日ANOVERVIEWOFSERVLETANDJSPTECHNOLOGYGildasAvoineandPhilippeOechslinEPFL,Lausanne,Switzerland1.1AServlet'sJobServletsareJavaprogramsthatrunonWeborapplicationservers,actingasamiddlelayerbetweenrequestscomingfromWebbrowsersorotherclientsanddatabasesorapplicationsontheserver.Theirjobistoperformthefollowingtasks,asillustratedinFigure1-1.Figure1-11．Readtheexplicitdatasentbytheclient.TheendusernormallyentersthisdatainanHTMLformonaWebpage.However,thedatacouldalsocomefromanappletoracustomclientprogram.2．Readtheimplicitrequestdatasentbythebrowser.Figure1-1showsasinglearrowgoingfromtheclienttotheWebserver(thelayerwhereservletsandJSPexecute),buttherearereallytwovarietiesofdata:theexplicitdatathattheenduserentersinaformandthebehind-the-scenesinformation.Bothvarietiesarecritical.Theinformationincludescookies,informationaboutmediatypesandcompressionschemesthebrowserunderstands,andsoon.3．Generatetheresults.Thisprocessmayrequiretalkingtoadatabase,executinganRMIorEJBcall,invokingaWebservice,orcomputingtheresponsedirectly.Yourrealdatamaybeinarelationaldatabase.Fine.Butyourdatabaseprobablydoesn'tspeakorreturnresultsinHTML,sotheWebbrowsercan'ttalkdirectlytothedatabase.Evenifitcould,forsecurityreasons,youprobablywouldnotwantitto.Thesameargumentappliestomostotherapplications.YouneedtheWebmiddlelayertoextracttheincomingdatafromthestream,talktotheapplication,andembedtheresultsinsideadocument.4．Sendtheexplicitdata(i.e.,thedocument)totheclient.Thisdocumentcanbesentinavarietyofformats,includingtext(HTMLorXML),binary(GIFimages),orevenacompressedformatlikegzipthatislayeredontopofsomeotherunderlyingformat.But,HTMLisbyfarthemostcommonformat,soanimportantservlet/JSPtaskistowraptheresultsinsideofHTML.5．Sendtheimplicitresponsedata.Figure1-1showsasinglearrowgoingfromtheWebmiddlelayer(theservletorJSPpage)totheclient.But,therearereallytwovarietiesofdatasent:thedocumentitselfandthebehind-the-scenesinformation.Again,bothvarietiesarecriticaltoeffectivedevelopment.Sendingresponsedatainvolvestellingthebrowserorotherclientwhattypeofdocumentisbeingreturned(e.g.,HTML),settingcookiesandcachingparameters,andothersuchtasks.1.2WhyBuildWebPagesDynamically?manyclientrequestscanbesatisfiedbyprebuiltdocuments,andtheserverwouldhandletheserequestswithoutinvokingservlets.Inmanycases,however,astaticresultisnotsufficient,andapageneedstobegeneratedforeachrequest.ThereareanumberofreasonswhyWebpagesneedtobebuilton-the-fly:1．TheWebpageisbasedondatasentbytheclient.Forinstance,theresultspagefromsearchenginesandorder-confirmationpagesatonlinestoresarespecifictoparticularuserrequests.Youdon'tknowwhattodisplayuntilyoureadthedatathattheusersubmits.Justrememberthattheusersubmitstwokindsofdata:explicit(i.e.,HTMLformdata)andimplicit(i.e.,requestheaders).Eitherkindofinputcanbeusedtobuildtheoutputpage.Inparticular,itisquitecommontobuildauser-specificpagebasedonacookievalue.2．TheWebpageisderivedfromdatathatchangesfrequently.Ifthepagechangesforeveryrequest,thenyoucertainlyneedtobuildtheresponseatrequesttime.Ifitchangesonlyperiodically,however,youcoulddoittwoways:youcouldperiodicallybuildanewWebpageontheserver(independentlyofclientrequests),oryoucouldwaitandonlybuildthepagewhentheuserrequestsit.Therightapproachdependsonthesituation,butsometimesitismoreconvenienttodothelatter:waitfortheuserrequest.Forexample,aweatherreportornewsheadlinessitemightbuildthepagesdynamically,perhapsreturningapreviouslybuiltpageifthatpageisstilluptodate.3．TheWebpageusesinformationfromcorporatedatabasesorotherserver-sidesources.Iftheinformationisinadatabase,youneedserver-sideprocessingeveniftheclientisusingdynamicWebcontentsuchasanapplet.Imagineusinganappletbyitselfforasearchenginesite:"Downloading50terabyteapplet,pleasewait!"Obviously,thatissilly;youneedtotalktothedatabase.GoingfromtheclienttotheWebtiertothedatabase(athree-tierapproach)insteadoffromanappletdirectlytoadatabase(atwo-tierapproach)providesincreasedflexibilityandsecuritywithlittleornoperformancepenalty.Afterall,thedatabasecallisusuallytherate-limitingstep,sogoingthroughtheWebserverdoesnotslowthingsdown.Infact,athree-tierapproachisoftenfasterbecausethemiddletiercanperformcachingandconnectionpooling.Inprinciple,servletsarenotrestrictedtoWeborapplicationserversthathandlerequestsbutcanbeusedforothertypesofserversaswell.Forexample,servletscouldbeembeddedinFTPormailserverstoextendtheirfunctionality.And,aservletAPIforSIP(SessionInitiationProtocol)serverswasrecentlystandardized(see:///en/jsr/detail?id=116).Inpractice,however,thisuseofservletshasnotcaughton,andwe'llonlybediscussingservlets.1.3TheAdvantagesofServletsOver"Traditional"CGIJavaservletsaremoreefficient,easiertouse,morepowerful,moreportable,safer,andcheaperthantraditionalCGIandmanyalternativeCGI-liketechnologies.1．EfficientWithtraditionalCGI,anewprocessisstartedforeachrequest.IftheCGIprogramitselfisrelativelyshort,theoverheadofstartingtheprocesscandominatetheexecutiontime.Withservlets,theJavavirtualmachinestaysrunningandhandleseachrequestwithalightweightJavathread,notaheavyweightoperatingsystemprocess.Similarly,intraditionalCGI,ifthereareNrequeststothesameCGIprogram,thecodefortheCGIprogramisloadedintomemoryNtimes.Withservlets,however,therewouldbeNthreads,butonlyasinglecopyoftheservletclasswouldbeloaded.Thisapproachreducesservermemoryrequirementsandsavestimebyinstantiatingfewerobjects.Finally,whenaCGIprogramfinisheshandlingarequest,theprogramterminates.Thisapproachmakesitdifficulttocachecomputations,keepdatabaseconnectionsopen,andperformotheroptimizationsthatrelyonpersistentdata.Servlets,however,remaininmemoryevenaftertheycompletearesponse,soitisstraightforwardtostorearbitrarilycomplexdatabetweenclientrequests.2．ConvenientServletshaveanextensiveinfrastructureforautomaticallyparsinganddecodingHTMLformdata,readingandsettingheaders,handlingcookies,trackingsessions,andmanyothersuchhigh-levelutilities.InCGI,youhavetodomuchofthisyourself.Besides,ifyoualreadyknowtheJavaprogramminglanguage,whylearnPerltoo?You'realreadyconvincedthatJavatechnologymakesformorereliableandreusablecodethandoesVisualBasic,VBScript,orC++.Whygobacktothoselanguagesforserver-sideprogramming?3．PowerfulServletssupportseveralcapabilitiesthataredifficultorimpossibletoaccomplishwithregularCGI.ServletscantalkdirectlytotheWebserver,whereasregularCGIprogramscannot,atleastnotwithoutusingaserver-specificAPI.CommunicatingwiththeWebservermakesiteasiertotranslaterelativeURLsintoconcretepathnames,forinstance.Multipleservletscanalsosharedata,makingiteasytoimplementdatabaseconnectionpoolingandsimilarresource-sharingoptimizations.Servletscanalsomaintaininformationfromrequesttorequest,simplifyingtechniqueslikesessiontrackingandcachingofpreviouscomputations.4．PortableServletsarewrittenintheJavaprogramminglanguageandfollowastandardAPI.ServletsaresupporteddirectlyorbyapluginonvirtuallyeverymajorWebserver.Consequently,servletswrittenfor,say,MacromediaJRuncanrunvirtuallyunchangedonApacheTomcat,MicrosoftInternetInformationServer(withaseparateplugin),IBMWebSphere,iPlanetEnterpriseServer,Oracle9iAS,orStarNineWebStar.TheyarepartoftheJava2Platform,EnterpriseEdition(J2EE;see://java.sun/j2ee/),soindustrysupportforservletsisbecomingevenmorepervasive.5．InexpensiveAnumberoffreeorveryinexpensiveWebserversaregoodfordevelopmentuseordeploymentoflow-ormedium-volumeWebsites.Thus,withservletsandJSPyoucanstartwithafreeorinexpensiveserverandmigratetomoreexpensiveserverswithhigh-performancecapabilitiesoradvancedadministrationutilitiesonlyafteryourprojectmeetsinitialsuccess.ThisisincontrasttomanyoftheotherCGIalternatives,whichrequireasignificantinitialinvestmentforthepurchaseofaproprietarypackage.Priceandportabilityaresomewhatconnected.Forexample,Martytriestokeeptrackofthecountriesofreadersthatsendhimquestionsbyemail.Indiawasnearthetopofthelist,probably#2behindtheU.S.MartyalsotaughtoneofhisJSPandservlettrainingcourses(see://courses.coreservlets/)inManila,andtherewasgreatinterestinservletandJSPtechnologythere.Now,whyareIndiaandthePhilippinesbothsointerested?Wesurmisethattheansweristwofold.First,bothcountrieshavelargepoolsofwell-educatedsoftwaredevelopers.Second,bothcountrieshave(orhad,atthattime)highlyunfavorablecurrencyexchangeratesagainsttheU.S.dollar.So,buyingaspecial-purposeWebserverfromaU.S.companyconsumedalargepartofearlyprojectfunds.But,withservletsandJSP,theycouldstartwithafreeserver:ApacheTomcat(eitherstandalone,embeddedintheregularApacheWebserver,orembeddedinMicrosoftIIS).Oncetheprojectstartstobecomesuccessful,theycouldmovetoaserverlikeCauchoResinthathadhigherperformanceandeasieradministrationbutthatisnotfree.ButnoneoftheirservletsorJSPpageshavetoberewritten.Iftheirprojectbecomesevenlarger,theymightwanttomovetoadistributed(clustered)environment.Noproblem:theycouldmovetoMacromediaJRunProfessional,whichsupportsdistributedapplications(Webfarms).Again,noneoftheirservletsorJSPpageshavetoberewritten.Iftheprojectbecomesquitelargeandcomplex,theymightwanttouseEnterpriseJavaBeans(EJB)toencapsulatetheirbusinesslogic.So,theymightswitchtoBEAWebLogicorOracle9iAS.Again,noneoftheirservletsorJSPpageshavetoberewritten.Finally,iftheirprojectbecomesevenbigger,theymightmoveitoffoftheirLinuxboxandontoanIBMmainframerunningIBMWebSphere.Butonceagain,noneoftheirservletsorJSPpageshavetoberewritten.6．SecureOneofthemainsourcesofvulnerabilitiesintraditionalCGIstemsfromthefactthattheprogramsareoftenexecutedbygeneral-purposeoperatingsystemshells.So,theCGIprogrammermustbecarefultofilteroutcharacterssuchasbackquotesandsemicolonsthataretreatedspeciallybytheshell.Implementingthisprecautionisharderthanonemightthink,andweaknessesstemmingfromthisproblemareconstantlybeinguncoveredinwidelyusedCGIlibraries.AsecondsourceofproblemsisthefactthatsomeCGIprogramsareprocessedbylanguagesthatdonotautomaticallycheckarrayorstringbounds.Forexample,inCandC++itisperfectlylegaltoallocatea100-elementarrayandthenwriteintothe999th"element,"whichisreallysomerandompartofprogrammemory.So,programmerswhoforgettoperformthischeckopenuptheirsystemtodeliberateoraccidentalbufferoverflowattacks.Servletssufferfromneitheroftheseproblems.Evenifaservletexecutesasystemcall(e.g.,withRuntime.execorJNI)toinvokeaprogramonthelocaloperatingsystem,itdoesnotuseashelltodoso.And,ofcourse,arrayboundscheckingandothermemoryprotectionfeaturesareacentralpartoftheJavaprogramminglanguage.7．MainstreamTherearealotofgoodtechnologiesoutthere.Butifvendorsdon'tsupportthemanddevelopersdon'tknowhowtousethem,whatgoodarethey?ServletandJSPtechnologyissupportedbyserversfromApache,Oracle,IBM,Sybase,BEA,Macromedia,Caucho,Sun/iPlanet,NewAtlanta,ATG,Fujitsu,Lutris,Silverstream,theWorldWideWebConsortium(W3C),andmanyothers.Severallow-costpluginsaddsupporttoMicrosoftIISandZeusaswell.TheyrunonWindows,Unix/Linux,MacOS,VMS,andIBMmainframeoperatingsystems.TheyarethesinglemostpopularapplicationoftheJavaprogramminglanguage.TheyarearguablythemostpopularchoicefordevelopingmediumtolargeWebapplications.Theyareusedbytheairlineindustry(mostUnitedAirlinesandDeltaAirlinesWebsites),e-commerce(ofoto),onlinebanking(FirstUSABank,BancoPopulardePuertoRico),Websearchengines/portals(excite),largefinancialsites(AmericanCenturyInvestments),andhundredsofothersitesthatyouvisiteveryday.Ofcourse,popularityaloneisnoproofofgoodtechnology.Numerouscounter-examplesabound.Butourpointisthatyouarenotexperimentingwithanewandunproventechnologywhenyouworkwithserver-sideJava.

Servlet和JSP技術簡述GildasAvoineandPhilippeOechslinEPFL,Lausanne,SwitzerlandServlet的功能Servlets是運行在Web或應用效勞器上的Java程序，它是一個中間層，負責連接來自Web瀏覽器或其他客戶程序的請求和效勞器上的數(shù)據(jù)庫或應用程序。Servlet的工作是執(zhí)行西門的任務，如圖1.1所示。圖1.1Web中間件的作用〔1〕讀取客戶發(fā)送的顯式數(shù)據(jù)。最終用戶一般在頁面的HTML表單中輸入這些數(shù)據(jù)。然而，數(shù)據(jù)還有可能來自applet或定制的客戶程序。〔2〕讀取由瀏覽器發(fā)送的隱式請求數(shù)據(jù)。圖1.1中顯示了一條從客戶端到Web效勞器的單箭頭，但實際上從客戶端傳送到Web效勞器的數(shù)據(jù)有兩種，它們分別為用戶在表單中輸入的顯式數(shù)據(jù)，以及后臺的信息。兩種數(shù)據(jù)都很重要。信息包括cookie、瀏覽器所能識別的媒體類型和壓縮模式等。〔3〕生成結果。這個過程可能需要訪問數(shù)據(jù)庫、執(zhí)行RMI或EJB調用、調用Web效勞，或者直接計算得出對應的響應。實際的數(shù)據(jù)可能存儲在關系型數(shù)據(jù)庫中。該數(shù)據(jù)庫可能不理解，或者不能返回HTML形式的結果，所有Web瀏覽器不能直接與數(shù)據(jù)庫進行會話。即使它能夠做到這一點，為了平安上的考慮，我們也不希望讓它這么做。對應大多數(shù)其他應用程序，也存在類似的問題。因此，我們需要Web中間層從流中提取輸入數(shù)據(jù)，與應用程序會話，并將結果嵌入到文檔中。〔4〕向客戶發(fā)送顯式數(shù)據(jù)〔即文檔〕。這個文檔可以用各種格式發(fā)送，包括文本〔HTML或XML〕，二進制〔GIF圖〕，甚至可以式建立在其他底層格式之上的壓縮格式，如gzip。但是，到目前為止，HTML式最常用的格式，故而servelt和JSP的重要任務之一就式將結果包裝到HTML中。〔5〕發(fā)送隱式的響應數(shù)據(jù)。圖1.1中顯示了一條從Web中間層到客戶端的單箭頭。但是，實際發(fā)送的數(shù)據(jù)有兩種：文檔本身，以及后臺的信息。同樣，兩種數(shù)據(jù)對開發(fā)來說都式至關重要的。響應數(shù)據(jù)的發(fā)送過程涉及告知瀏覽器或其他客戶程序所返回文檔的類型〔如HTML〕，設置cookie和緩存參數(shù)，以及其他類似的任務。2.

動態(tài)構建網(wǎng)頁的原因預先建立的文檔可以滿足客戶的許多請求，效勞器無需調用servlet就可以處理這些請求。然而，許多情況下靜態(tài)的結果不能滿足要求，我們需要針對每個請求生成一個頁面。實時構建頁面的理由有很多種：1、網(wǎng)頁基于客戶發(fā)送的數(shù)據(jù)。例如，搜索引擎生成的頁面，以及在線商店的訂單確認頁面，都要針對特定的用戶請求而產(chǎn)生。在沒有讀取到用戶提交的數(shù)據(jù)之前，我們不知道應該顯示什么。要記住，用戶提交兩種類型的數(shù)據(jù)：顯示〔即HTML表單的數(shù)據(jù)〕和隱式〔即請求的報頭〕。兩種輸入都可用來構建輸出頁面。基于cookie值針對具體用戶構建頁面的情況尤其普遍。2、頁面由頻繁改變的數(shù)據(jù)導出。如果頁面需要根據(jù)每個具體的請求做出相應的改變，當然需要在請求發(fā)生時構建響應。但是，如果頁面周期性地改變，我們可以用兩種方式來處理它：周期性地在效勞器上構建新的頁面〔和客戶請求無關〕，或者僅僅在用戶請求該頁面時再構建。具體應該采用哪種方式要根據(jù)具體情況而定，但后一種方式常常更為方便，因為它只需簡單地等待用戶的請求。例如，天氣預報或新聞網(wǎng)站可能會動態(tài)地構建頁面，也有可能會返回之前構建的頁面〔如果它還是最新的話〕。3、頁面中使用了來自公司數(shù)據(jù)庫或其他數(shù)據(jù)庫斷數(shù)據(jù)源的信息。如果數(shù)據(jù)存儲在數(shù)據(jù)庫中，那么，即使客戶端使用動態(tài)Web內容，比方applet，我們依舊需要執(zhí)行效勞器端處理。想象以下，如果一個搜索引擎網(wǎng)站完全使用applet，那么用戶將會看到：“正在下載50TB的applet，請等待！”。顯然，這樣很愚蠢；這種情況下，我們需要與數(shù)據(jù)庫進行會話。從客戶端到Web層再到數(shù)據(jù)庫〔三層結構〕，要比從applet直接到數(shù)據(jù)庫〔二層結構〕更靈活，也更平安，而性能上的損失很少甚至沒有。畢竟數(shù)據(jù)庫調用通常是對速度影響最大的步驟，因而，經(jīng)過中間層可以執(zhí)行高速緩存和連接共享。理論上講，servelt并非只用于處理請求的Web效勞器或應用效勞器，它同樣可以用于其他類型的效勞器。例如，servlet能夠嵌入到FTP或郵件效勞器中，擴展他們的功能。而且，用于會話啟動協(xié)議效勞器的servletAPI最近已經(jīng)被標準化〔參見:///en/jsr/detail?id=116〕。但在實踐中，servelt的這種用法尚不流行，在此，我們只論述Servlet。Servlet相對于“傳統(tǒng)”CGI的優(yōu)點和傳統(tǒng)CGI及許多類CGI技術相比，Javaservelt效率更高、更易用、更強大、更容易移植、更平安、也更廉價。1、效率應用傳統(tǒng)的CGI，針對每個請求都用啟動一個新的進程。如果CGI程序自身相比照擬簡短，那么啟動進程的開銷會占用大局部執(zhí)行時間。而使用servelt，Java虛擬時機一直運行，并用輕量級的Java線程處理每個請求，而非重量級的操作系統(tǒng)進程。類似地，應用傳統(tǒng)的CGI技術，如果存在對同一CGI程序的N個請求，那么CGI程序的代碼會載入內存N次。同樣的情況，如果使用servlet那么啟動N個線程，單僅僅載入servlet類的單一副本。這種方式減少了效勞器的內存需求，通過實例化更少的對象從而節(jié)省了時間。最后，當CGI程序結束對請求的處理之后，程序結束。這種方式難以緩存計算結果，保持數(shù)據(jù)庫連接翻開，或是執(zhí)行依靠持續(xù)性數(shù)據(jù)的其他優(yōu)化。然而，servelt會一直停留在內存中〔即使請求處理完畢〕，因而可以直接存儲客戶請求之間的任意復雜數(shù)據(jù)。2、便利Servelt提供大量的根底構造，可以自動分析和解碼HTML的表單數(shù)據(jù)，讀取和設置報頭，處理cookie，跟蹤會話，以及其他次類高級功能。而在CGI中，大局部工作都需要我們資金完成。另外，如果您已經(jīng)了解了Java編程語言，為什么還有學校Perl呢？您已經(jīng)成認應用Java技術編寫的代碼要比VisualBasic，VBScript或C＋＋編寫的代碼更可靠，且更易重用，為什么還有倒退回去選擇那些語言來開發(fā)效勞器端的程序呢？3、強大Servlet支持常規(guī)CGI難以實現(xiàn)或根本不能實現(xiàn)的幾項功能。Servlet能夠直接于Web效勞器對話，而常規(guī)的CGI程序做不到這一點，至少在不使用效勞器專有API的情況下是這樣。例如，與Web效勞器的通信使得講相對URL轉換成具體的路徑名變得更為容易。多個servelt還可以共享數(shù)據(jù)，從而易于實現(xiàn)數(shù)據(jù)庫連接共享和類似的資源共享優(yōu)化。Servelt還能維護請求之間的信息，使得諸如會話跟蹤和計算結果緩存等技術變得更為簡單。4、可移植性Servelt使用Java編程語言，并且遵循標準的API。所有主要的Web效勞器。實際上都直接或通過插件