Automated generation of a World Wide Web-based data entry and check program for medical applications

Hemu~lobin:
SIZE = “l”>.

c. Password t?pei/HJ> Pleaseenter your second password for the registration of your patient:

---

SELECT tag+Hl> Pleaseselect your institution from the list below. l.The Fourth Dept. of Surgery, Univ. of Tokyo. 2.The Second Dept. of Surgery, Keiyo Univ. 3.The First Dept. of Surgery, Talky0 Regional Cancer Center. S.The First Dept. of Surgery, Kanagana Medical School.
of Surgery, Tokyo Metropolitan Nerima Hospital.

---

TEXTAREA tagQHI> Pleasewrite your questions or correspondence in the area below. .CP:,<br /> <br /> </FORM> Fig. 2. The HTML form produced from the extended HTML form in Fig. 1 by AUTOFORM. that ali of rhe document below is written in HTML.<br /> <br /> The file name is “o-form.html”.<br /> <br /> Note<br /> <br /> T. Kiuchi~ S. Kuihnra / Computer Methods and Programs in Biomedicine 52 (1997) 129-138<br /> <br /> 135<br /> <br /> Fig. 3. Re~rese~~atio~ of the HTML form in Fig. 2 in a user agent. Sex and age are required items and the others are not. The value of age shcufd be an integer and be between 18 and 60. Otherwise this form will not be accepted and the users are warned of illegal data ento. The value of hemoglobin should be between 11.O and 16.0, otherwise this form will be treated likewise.<br /> <br /> errors are presented and the user is requested to re-enter the data. The data checking proceeds in the following order: (I) Deficit check This type of check is performed when a<br /> <br /> REQUIRED parameter is specified except for RADIO type in a INPUT tag. (2) Data length check. The lengths of all the entered data are checked to see whether they exceed their expected lengths.<br /> <br /> 136<br /> <br /> T. Kiuchi,<br /> <br /> Table 2 Specifications of the HTML<br /> <br /> S. Kaihara<br /> <br /> 1 Computer<br /> <br /> form-compliant<br /> <br /> Program Generators<br /> <br /> -.<br /> <br /> Methods<br /> <br /> Polyform Un-CGI HTML Wizard<br /> <br /> Any platforms where a Pert runs MS-Windows UNIX BUS-Windows<br /> <br /> in Biomedicine<br /> <br /> 52 (1997)<br /> <br /> 129-139<br /> <br /> CC1 generators<br /> <br /> Source codes<br /> <br /> P!atform<br /> <br /> AUTOFORM<br /> <br /> and Progrnms<br /> <br /> Available Not available Available Not available<br /> <br /> Resultant CGI programs ________ Data check Deficit, type, range, and logical check Deficit NO<br /> <br /> ho<br /> <br /> The expected data length is determined as follows: (a) INPUT tag, RADIO type: the length of a string specified in a VALUE parameter. No de= fault value. (b) INPUT tag, CHECRBOX type: the length of a string specified in a VALUE parameter. If not specified, the default maximum length is two, which is the length of the default value, “on”. (c) INPUT tag, TEXT type and PASSWORD type: the value specified in MAXLENGTH is used. If not specified, the default valne is 20. (d) SELECT tag: the largest value among the lengths of strings specified in OPTION tags. (e) TEXTAREA tag: the length of the maximum length of the entered data is calculated using COLS and ROWS parameters. If COLS and/or ROWS parameters are not specified in the extended HTML form, AUTOFORM assumes that the value of COLS and ROWS are 20 and 4, respectively aml specifies those parameters in the resultant HTl~L form accordingly. (3) Check for the possible data. As for RADIO type and CHECKBOX type in INPUT tag and SELECT tag, the possible data which can be sent from clients are pre-determined. In these cases, AUTOFORM checks whether or not the entered string is one of the possible data. (4) Range check for numerical values. As for INT and DECIMAL data type in TEXT type in lNPUT tag, AUIOFORM checks whether or not the entered numerical value is smaller than the maximum value specified using a MAXVALUE parameter and is larger than the minimum value specified using a MINVALU~~ parameter.<br /> <br /> Data check for security<br /> <br /> Source codes<br /> <br /> Available<br /> <br /> Available<br /> <br /> Not available Not available Not available<br /> <br /> Not available Available Available<br /> <br /> (5) Logical check of possible combinations of data. For all kinds of variables, logical checks can be performed according to the formulae specified in LCHECK tags. (6) Security check of a string. As for CHAR data type in TEXT type in INPUT tag, A~OF~R~I checks whither or not the string entered contains potentialiy hazardous meta-characters which may have a special meaning for shells if ‘SECURITY = “secure” is specified. By default, AUTOFORM does not check it.<br /> <br /> 4. Discussion<br /> <br /> The CGI programs generated by AUTOFORM may not be used as they are and further customization may be necessary for some purposes. However, by using AUTOFORM, the time and labor which is usually necessary for preparing CGI programs can be dramatically reduced. In addition, the resultant CGI programs are more reliable than those written from scratch. Programmers can save the time usually spent on programming, testing data entry, and checking parts of the CGI programs to concentrate on other things such as data calculation and processing Although the functions of the generated CGI program are limited to just checking entered data, recording them and returning entered values to users in simple format, it may be sufficient for the collection of data. Only a minimum knowledge of<br /> <br /> C language is necessary to alter the contents of an HTML document returned to users. Ther? are a few programs which can generate CGI programs that handles the data entered using HTML form, such as Polyform [lo], LJn-CGI[ll]l and HTiLlL Wizard [12]. Their characteristics are listed in Table 2. These programs, however, do not meet our three requirements concerning data collection in the medical fields: (1) data check, including deficits, types, and range of data and logical errors for the data quality; (2) data length check and detection of meta-characters for server security; and (3) the avaiIability of source codes of both CGI generators and resultant CC1 programs for furLher customization. 4.2. Security considerations<br /> <br /> By using AUTOFORM, secure CGI prograllls can be generated even if one does not know how to write secure CGI programs. We believe the generated CGI programs are usually more secure than those presently available on the Internet. It is much easier to develop a program which generat.e CC1 programs in Perl. However, Per1 script needs a Per1 interpreter ready to run on a ~W server. It would be desirable, from the view point of security, to avoid putting a powerful interpreter on the server. This is the reason for us to adopt the C language for CGI programs. As the Internet is universally accessible, the possibility of data tampering limits its use for research by the medical community. In HTTPbased communication currently used, all data are transferred in unencrypted (plain) form through the Internet in the current HTTP~l.0 speci~catiol~. Recently, some mechanisms for secure HTTP communications using cipher technology were proposed and, among them, Secure Socket La:yer (SLL) developed by NetScape Communications is available at present [13--161. We think that the security problem concerning data tampering has become reduced now and will be solved in the near fmure. This will result in WWW-based form having an important role in network-based data collection for medical research. Accordingly, we think that the importance of our program will be increased. It should be noted that WWW-based<br /> <br /> form can be used via privately-leased circuits and public telephone line, using TCP/IP protocol, and lthey are more secure than the Internet. But they are more costly and inconvenient. The TCPjIP connection method should be preferred, after considering the level of security required and costs.<br /> <br /> References 111T. Boutell (Maintainer<br /> <br /> in August, 1996), World Wide Web Frequently Asked Questions, available on the World Wide Web as “ht~p:~/w~.bo~~tell.com~boutcIl~faq~” (1996). PI T. Berners-Lee. R.T. Fielding and H.F. Nielsen, Hypertext Transfer Protocol-HTTP/1.0. RFC 1945, available on the World Wide Web as “http://ds.internic.net/rfc/ rfcl945.txt” (1996). t31 D. Raggett, HyperText Markup Language Specification Version 3.0, available on the World Wide Web as “http:// ww~v.w3.or~~pub/~~WWlMarkUp/htlnl3]CoverPage.html” (1995). I41 T. Kiuchi, Y. Ohashi, M. Konishi, T. Kosuge, Y. Bandai and T. Kakizoe, A World Wide Web-based User Interface for a Data Management System -ror Use in Multi-institutional Clinical Trials-Development and Experimental Operation of an Automated Patient Registration and Random Allocation System (Controlled Clinical Trials 1996) in press. 151A Randomized trial of the effect of Bonnarine on Type C hepatitis (a project now under way). 161National Center for Supercomputin~ Association, The Common Gateway Interface, available on the World Web as “ http://hoohoo.ncsa.uiuc.edu/cgi/” (1996). 171 National Center for Supercomputing Association, httpd version 1.4, public domain software with documentation, available from an anonymous FTP server, “ftp.ncsa.uiuc.edu” (1995). IsI National Center for Supercomputing Association, NCSA Mosaic for X version 2.0 Fill-Gut Form Support, an HTML document included in NCSA httpd version 1.4 (I 995).<br /> <br /> P. Phillips, CGI security, on-line HTML document, available on the World-Wide-Web as “http:// www.primus.com/staff/paulp/cgi-security/” (1995). 1101Willow Glen Graphics, Polyform version 2.3, software and information available on the World Wide Web as “http:~/~gg.com~’ (1995). illi S. Grimm, Un-CGI version 1.7, software and info~atioll available on the World Wide Web as “http:// www.hyperion.com/ - koreth/uncgi.ht.mI” (1996). [121HTML Wizard Web Developers Warehouse, software and information available on the World Wide Web as “http://htechno.com/wdw/index.html” (1995). [91<br /> <br /> 138<br /> <br /> T. Kiuchi, S. Kaihara 1 Computer Met/lo& and Programs in Biomedicine 52 (1997) 129-138<br /> <br /> [13] E. Rescorla and A. Schiffman, The Secure Hypertext. Transfer Protocol, Internet Draft, expired, available or. the World Wide Web as “http://ftp.umin.u-tokyo.ac.jp, interne:/draft-rescorla-shttp-OO.txt” (1994). [14] P.M. Hallam-Baker and A. Shen, Security Scheme for the World Wide Web, available on the World Wide Web as “http:l/www.w3,org/hypertext/WWW/Shen/ref/securityspechtml” (1995).<br /> <br /> [I51 K.E.B. Hickman and T. Elgamal, The SSL Protocol, Internet Draft, work in progress, available on the World Wide Web as “http://ds.internic.net/internet-drafts/drafthickman-netscape-ssl-Ol.txt” (1995). [16] S. Spero, Progress on HTTP-NG, available on the World Wide Web as “http://www.w3.org/hypertext/WWWlProtocols/HTTP-NG/http-ng-statushtml”.<br /> <br /> </div> </div> </div> </div> </div> </div> </div> </div> <div class="modal fade" id="report" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <form role="form" method="post" action="https://c.coek.info/report/automated-generation-of-a-world-wide-web-based-data-entry-and-check-program-for-" style="border: none;"> <div class="modal-header"> <button type="button" class="close" data-dismiss="modal" aria-hidden="true">×</button> <h4 class="modal-title">Report "Automated generation of a World Wide Web-based data entry and check program for medical applications"</h4> </div> <div class="modal-body"> <div class="form-group"> <label>Your name</label> <input type="text" name="name" required="required" class="form-control" /> </div> <div class="form-group"> <label>Email</label> <input type="email" name="email" required="required" class="form-control" /> </div> <div class="form-group"> <label>Reason</label> <select name="reason" required="required" class="form-control"> <option value="">-Select Reason-</option> <option value="pornographic" selected="selected">Pornographic</option> <option value="defamatory">Defamatory</option> <option value="illegal">Illegal/Unlawful</option> <option value="spam">Spam</option> <option value="others">Other Terms Of Service Violation</option> <option value="copyright">File a copyright complaint</option> </select> </div> <div class="form-group"> <label>Description</label> <textarea name="description" required="required" rows="3" class="form-control" style="border: 1px solid #cccccc;">