内部文档数据替换为NodeJS

Question

So, I'm am fairly new to NodeJS and any programming in general, and I'm not sure if I'm going about this correctly. I've been practicing things like this since I was 9 or 10 (currently 13). So before I delved into NodeJS anymore, I wanted to make sure I'm using it correctly.

So, after working with PHP for some time. You can simply "echo" something in the document to return data from the server, such as an IP address.

<?php
  echo $_SERVER["REMOTE_ADDR"];
?>

This would effectively echo the user's IP wherever the bit of PHP is located in the document - parsed by Apache's module (right?)

What is the con of this? Is there any way to re-create NodeJS syntax with-in a document which is then parsed by the NodeJS HTTP server to get any NodeJS between, lets say <nodejs>script</nodejs>.

So, in shorter, more understandable terms. Is it technically safe to take NodeJS out of a document before it's displayed - eval that Nodejs script, then remove it and display it.

Although this sounds kinda sketchy. So I'm currently using an alternative method. But I'm not sure if this would technically be safe either.

Right now, in the document, I would have something like <p>Your IP is [*IP*]</p>, which I use NodeJS's file system module to do something like this:

app.get("/", function(req, res){
  res.send(fs.readFileSync(__dirname + "index.html").replace(/\[\*IP\*\]/g, req.connection.remoteAddress));
});

Although, this just seems a little iffy to me. And since I haven't got a lot of experience on the security aspect of web development, I was hoping I could get some insite on how this is safe or unsafe. How would I accomplish this?

Thanks for taking the time to read and help me improve my knowledge on this subject!

Answer 1

I don't think it's a question of security or something like that, but a question of how Node.js works compared to PHP.

PHP is basically, as you wrote correctly, file based. So you create a text file with the extension .php, put your HTML markup and maybe some logic (like printing the ip address) in it and that's it. The rest is done by the web server, mainly Apache, which sends each request to a .php-file through "the PHP engine" which interprets your code and renders the result to the client (which in your case is your browser).

Node.js does not work that way. Instead of looking for a file which is then interpreted and returned, the most common (not the only) way is to use a "middleware" which is processing the request.

First it looks after an "endpoint" for each request. Broadly speaking you can register a function for each route, as you did in your example code for the route "/" (could also be ("/what-is-my-ip").

That function is your "controller action" which could perform some business logic, as fetching the ip address.

After finishing that, it passes the result to a view engine or simply returns a simple view trough that engine.

A view is basically what your .php would be, but it does not contain any logic, which is the main difference to PHP.

It's mainly working after the Model View Controller pattern.

Some view engines:

• Handlebars: https://www.npmjs.org/package/express-handlebars
• Jade: https://www.npmjs.org/package/jade
• Vash: https://www.npmjs.org/package/vash
• EJS: https://www.npmjs.org/package/ejs