One major difference between Challenger and other web servers is that Challenger is written in the same language, Pike, that is used for third-party extensions and scripts. Usually you write the server in a compiled language like C or C++ and then let third-party developers use another interpreted language like Perl, JavaScript or Visual Basic for extensions.

That Challenger is written in its extension language means a lot for how powerful extensions you can make. You use the same tools as the Challenger developers. The line blurs between making extensions to the server and developing the server itself. Since the whole server is delivered with source code you can find out how the Challenger developers solved problems.

There are four ways of making extensions written in Pike. CGI scripts can be written in Pike, as well as any other language. Pike scripts work like CGI scripts, but are handled internally in the server. The <pike> tag can be used to include Pike code within RXML pages. Finally there are modules, that use the same API as the modules distributed with Challenger. Modules have access to all the functionality available in Challenger and are installed and configured through the configure interface.

There are security implications when using Pike scripts, the <pike> tag or modules. Since they are run in the actual server process, rather than as an external process, your Pike code will have access to many internal data structures of Challenger. It is for example quite easy to shut down the server from within a module. Therefore the system administrator of a Challenger server must trust her Pike programmers.

As always when it comes to web programming it is essential to treat user input with suspicion. Even though you only wanted a word of data the user could send megabytes of machine code. Fortunately Pike makes it hard to make errors in handling handling user input. It is however very important to understand the issue, especially when making scripts that start external programs, write user input back to RXML pages or connect to databases.