core

#!/usr/bin/lua
env={}
env.QUERY_STRING=os.getenv("QUERY_STRING")
-- start section which mniip wrote
local html_escape={["<"]="&lt;",[">"]="&gt;",["&"]="&amp;"}
local uri_escape=function(a)
	return ("%%%02x"):format(a:byte())
end
local uri_unescape=function(a)
	return string.char(tonumber(a,16))
end
escape={
	html=function(str)
		return (str:gsub("[<>&]",html_escape))
	end,
	url=function(str)
		return (str:gsub("[^a-zA-Z0-9_.~-]",uri_escape))
	end,
	shell=function(str)
		return (str:gsub("[ `~!#$&*()|\\'\";<>?{}]","\\%1"))
	end
}
query={} 
post={}
if env.QUERY_STRING then
	for param in env.QUERY_STRING:gmatch"[^&]+" do
		local key,value=param:match"^([^=]*)=(.*)$"
		if key then
			query[unescape.url(key)]=unescape.url(value)
		else
			table.insert(query,unescape.url(param))
		end
	end
end
local input=io.read"*a"
if input then
	for param in input:gmatch"[^&]+" do
		local key,value=param:match"^([^=]*)=(.*)$"
		if key then
			post[unescape.url(key)]=unescape.url(value)
		else
			table.insert(post,unescape.url(param))
		end
	end
end -- end section which mniip wrote

local f,err=loadstring(io.stdin:read'*a')
output={}
if err then
	print("content-type: text/html\n\n<h1>Syntax error:</h1><br>"..err)
else
	status,err=pcall(f)
	if status==0 or err==nil then 
		if err==nil then err="return is nil" end
		print("content-type: text/html\nStatus: 500 Internal Server Error\n\n<h1>Runtime error:</h1><br>"..err)
	else
		table.insert(output,err.contentType.."\n")
		for i=1,#err do
			if err[i]~=err.contentType then
				table.insert(output,err[i])
			end
		end
		output=table.concat(output,"\n")
    end
end

query.cgi

#!/var/www/cgi/core
s=""
for k,v in pairs(query) do
	s=s.."\n"..k.."="..v
end
function rdata() 
	local t={contentType="text/plain"} 
	table.insert(t,s) 
	return t
end
return rdata()