The language that wired the web—and still gets things done.

1987 · Perl 1.0

Built for

report generation, text extraction, system glue

Runs on

any Unix that already had a shell and a C compiler

The web

does not exist yet

Nothing to show here, and that is the point. There is no HTTP request in 1987 — the proposal that becomes the web is still two years away. Everything in the three nodes that follow is downstream of a language designed for text and glue, which is exactly why it was already installed on the machines the web arrived on.

1997 · CGI.pm enters core

#!/usr/bin/perl
use CGI;
my $q    = CGI->new;
my $name = $q->param('name');

print $q->header('text/html');
print "<h1>Hello, $name</h1>";← unescaped

The web is writable. The server forks, runs the interpreter, reads the reply from standard output, and the process exits. Line 7 puts the parameter straight into markup unescaped — the shape behind a very large share of that decade's vulnerabilities.

c. 2009 · PSGI and Plack

use Plack::Request;

my $app = sub {
    my $req  = Plack::Request->new(shift);
    my $name = $req->parameters->{name} // 'world';

    return [ 200, ['Content-Type' => 'text/plain'], ["Hello, $name\n"] ];← the whole spec
};

A hashref in, an arrayref out. That return value on line 7 — status, headers, body — is the whole specification. The application stops caring which server runs it, which is the decoupling the CGI.pm era never made.

Now · Mojolicious::Lite on PSGI

use Mojolicious::Lite -signatures;

get '/hello' => sub ($c) {
    my $name = $c->param('name') // 'world';
    $c->render(json => { hello => $name });← encoded, not concatenated
};

app->start;

Same request, same parameter, same eight lines of intent. What changed is not syntax: the interpreter stays resident between requests, the response is encoded rather than concatenated, and this file runs unmodified under any PSGI server.