>Can a CGI script find out the IP
>address of the connection on which the request was received?
It shouldn't care. The source of protection is the identity of the host, not the identity of the IP address.
In general, I don't recall that a CGI script can get the IP address of the caller. The usual strategy for establishing "sessions" is to use some sort of cookie with a short lived timeout.
>2) Servlets. From your description of servlets, it would seem as
>technically adequate a platform as CGIs. But since they aren't widely
>supported by ISPs, I see no advantage over CGIs.
My expectation is that ISPs are going to move from CGIs to servlets as soon as they can now that the major web servers support servlets adequately. For all of the problems of Java, servlets are way less powerful from a security perspective than CGI scripts, especially in JDK 1.2. Separate from this, there are *major* advantages in performance, as servlets remain resident in the server.
shap