How do you lock your web app data?

[Cary O'Brien]

I hate to be picky but..

In article <957286$kde$1 at reader1.imaginet.fr>,
Gilles Lenfant <glenfant at equod.com.nospam> wrote:
>If you play with lot of small files and few users you can use "lock files"
>with the same name as the file the user is supposed to modify.
>This is not "pythonic" but a general algorythm that can be done in python or
>whatever:
>
>start cgi
>if not exists "myfile.lock"

This looks ok, but there is a hole here.  Two processes can do the if
not exists before the touch and bad things will happen.  This will in
all likelyhood (murphy) happen sooner or later, most likely at times
of high system load and hence personal stress.

>  touch "myfile.lock"
>  # play with "myfile.txt"
>  ...
>  # end play with "myfile.txt"
>  rm "myfile.lock"
>else
>  reply "resource in use, come back later" to the user (or anything else
>relevant)
>endif
>end cgi
>

>Of course, this will not be appropriate to big traffic and if the cgi script
>crashes (beetween "# play..." and "# end play...") and leaves
>"myfile.lock"... nobody will be capable of using your application.
>

100% true, but the hole exists even if it doesn't crash.  Reliable
dotfile-locking is a pain, even on Unix where you know which
operations are atomic.  I have no clue about NT.  

>In some months, your application complexity will perhaps grow such that
>staying with cgi technology will lead to headaches for you and your server.
>
>There are better "pythonic" solutions than cgi for playing with shared
>complex objects and lots of users in a "safer" way. see Zope at www.zope.org
>that offers an open source Python based applications server that's better
>suited to complex Web based applications.
>

Absolutey!

Zope is definitely one good way to go.  As is an RDBMS, even if it
seems like overkil at the start.  Nothing like being able to add complex
features to the system with a couple of lines of sql.  (Zope plays 
nicely with most RDBMSes).

-- cary